SNS Topic Public Subscription Auditor

Audits AWS SNS topics for public subscription exposure (Principal:"*" with sns:Subscribe or sns:Publish in topic policy), missing KMS encryption (plaintext messages at rest), delivery-status logging gaps (silent message loss with no CloudWatch signal), cross-account subscription vectors, and FIFO deduplication misconfiguration. Emits a deterministic verdict (PUBLIC_SUBSCRIPTION | NO_ENCRYPTION | CONFIG_GAP | OK) per topic with enumerated findings and specific CLI remediation. Use when reviewing SNS topic policies, checking for public subscription access, validating encryption-at-rest, auditing delivery observability, or hardening message bus posture before production depl…