Fun fact: sns.amazonaws.com has no DMARC record. Basically all alerts from AWS can be forged or end up in your spam folder and you have no way to know they really came from Amazon. You might say: oh, there's probably a good reason they don't have DMARC, right? Apparently the reason is it's a feature request that they haven't gotten to. And SNS has been around for 12 years.
If I'm a hacker trying to phish someone into giving me their AWS creds, I'm faking CloudWatch alerts that say RDS is down and linking to my malware site. Because real CloudWatch alerts already end up in your spam folder (because no DKIM), no way to know if it's real or not unless you closely examine every link before clicking.
If I'm a hacker trying to phish someone into giving me their AWS creds, I'm faking CloudWatch alerts that say RDS is down and linking to my malware site. Because real CloudWatch alerts already end up in your spam folder (because no DKIM), no way to know if it's real or not unless you closely examine every link before clicking.