Project: KICS (Provisioning / Security & Compliance)
File: 9b6a3f5b-5fd6-40ee-9bc0-ed604911212d.md

title: SQS Policy With Public Access hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9b6a3f5b-5fd6-40ee-9bc0-ed604911212d Query name: SQS Policy With Public Access Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: Checks for dangerous permissions in Action statements in an SQS Queue Policy. This is deemed a potential security risk as it would allow various attacks to the queue<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" Resources: SampleSQSPolicy: Type: AWS::SQS::QueuePolicy Properties: Queues: "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" PolicyDocument: Statement: Action: "SQS:SendMessage" "SQS:CreateQueue" Effect: "Allow" Resource: "arn:aws:sqs:us-east-2:444455556666:queue2" Principal: AWS: "111122223333" "*" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="7" Resources: SampleSQSPolicy: Type: AWS::SQS::QueuePolicy Properties: Queues: "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" PolicyDocument: Statement: Action: "SQS:SendMessage" "SQS:AddPermission" Effect: "Allow" Resource: "arn:aws:sqs:us-east-2:444455556666:queue2" Principal: AWS: "111122223333" "arn:aws:iam::437628376:*" ``` ```json title="Positive test num. 3 - json file" hl_lines="9" { "Resources": { "SampleSQSPolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "Queues": [ "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" ], "PolicyDocument": { "Statement": [ { "Action": [ "SQS:SendMessage", "SQS:CreateQueue" ], "Effect": "Allow", "Resource": "arn:aws:sqs:us-east-2:444455556666:queue2", "Principal": { "AWS": [ "111122223333", "*" ] } } ] } } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="9" { "Resources": { "SampleSQSPolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "Queues": [ "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" ], "PolicyDocument": { "Statement": [ { "Principal": { "AWS": [ "111122223333", "arn:aws:iam::437628376:*" ] }, "Action": [ "SQS:SendMessage", "SQS:AddPermission" ], "Effect": "Allow", "Resource": "arn:aws:sqs:us-east-2:444455556666:queue2" } ] } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" Resources: SampleSQSPolicy: Type: AWS::SQS::QueuePolicy Properties: Queues: "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" PolicyDocument: Statement: Action: "SQS:SendMessage" "SQS:ReceiveMessage" Effect: "Allow" Resource: "arn:aws:sqs:us-east-2:444455556666:queue2" Principal: AWS: "111122223333" "*" ``` ```yaml title="Negative test num. 2 - yaml file" Resources: SampleSQSPolicy2: Type: AWS::SQS::QueuePolicy Properties: Queues: "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" PolicyDocument: Statement: Action: "SQS:SendMessage" "SQS:CreateQueue" Effect: "Allow" Resource: "arn:aws:sqs:us-east-2:444455556666:queue2" Principal: AWS: "111122223333" ``` ```yaml title="Negative test num. 3 - yaml file" Resources: SampleSQSPolicy3: Type: AWS::SQS::QueuePolicy Properties: Queues: "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" PolicyDocument: Statement: Action: "SQS:SendMessage" "SQS:CreateQueue" Effect: "Deny" Resource: "arn:aws:sqs:us-east-2:444455556666:queue2" Principal: AWS: "111122223333" "*" ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "Resources": { "SampleSQSPolicy": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "Queues": [ "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" ], "PolicyDocument": { "Statement": [ { "Action": [ "SQS:SendMessage", "SQS:ReceiveMessage" ], "Effect": "Allow", "Resource": "arn:aws:sqs:us-east-2:444455556666:queue2", "Principal": { "AWS": [ "111122223333", "*" ] } } ] } } } } } ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "Resources": { "SampleSQSPolicy2": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "Queues": [ "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" ], "PolicyDocument": { "Statement": [ { "Action": [ "SQS:SendMessage", "SQS:CreateQueue" ], "Effect": "Allow", "Resource": "arn:aws:sqs:us-east-2:444455556666:queue2", "Principal": { "AWS": [ "111122223333" ] } } ] } } } } } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "Resources": { "SampleSQSPolicy3": { "Properties": { "Queues": [ "https://sqs:us-east-2.amazonaws.com/444455556666/queue2" ], "PolicyDocument": { "Statement": [ { "Action": [ "SQS:SendMessage", "SQS:CreateQueue" ], "Effect": "Deny", "Resource": "arn:aws:sqs:us-east-2:444455556666:queue2", "Principal": { "AWS": [ "111122223333", "*" ] } } ] } }, "Type": "AWS::SQS::QueuePolicy" } } } ``` </details>