aws-mq-publicly-accessible

id: aws-mq-publicly-accessible
emits: ExposedToInternet
description: An Amazon MQ broker with PubliclyAccessible=true is reachable from the internet over wire-protocol
  ports; obtaining broker credentials is sufficient to publish messages and trigger bound Lambda consumers.
match:
- - broker: null
  - CanTrigger
  - consumer: null
where:
- node_type(?broker) == GenericMessaging
- ?broker.provider_type == 'AWS::AmazonMQ::Broker'
- ?broker.properties.PubliclyAccessible == true
emit:
  source_type: Messaging
  target_type: AnonymousIdentity
  source: ?broker
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "ACTIVE when mq:DescribeBroker returns PubliclyAccessible=true AND the security group attached\
    \ to the broker allows inbound traffic on the relevant wire-protocol port(s) from 0.0.0.0/0 (or a\
    \ broad CIDR). CONDITIONAL(network_ reachability) when security group rules restrict the inbound source\
    \ range even though the broker has a public endpoint \u2014 broad internet exposure is not confirmed\
    \ until security group evaluation. Broker authentication (wire- level username/password) is still\
    \ required; this edge captures public reachability, not unauthenticated access."
  confidence: 0.85
  derived_from:
  - mq:DescribeBroker -> PubliclyAccessible=true
  false_positive_note: 'PubliclyAccessible=true creates a publicly resolvable NLB endpoint, but security
    groups can still restrict which source IPs can reach the wire ports. Evaluate the security group inbound
    rules before setting state to ACTIVE: a public endpoint with a security group allowing only a known
    CIDR is CONDITIONAL(network_reachability). The broker still requires wire-level authentication (username/password);
    this edge does not imply unauthenticated access. Do not emit ExposedToInternet with target=AnonymousIdentity
    if the security group denies inbound traffic from public internet sources on all wire-protocol ports.'
  narrative: '{broker.name} is deployed with PubliclyAccessible=true and a public NLB endpoint; any internet
    host that obtains broker credentials can connect over wire protocols (ActiveMQ ports: 61616/5671/8883/61614;
    RabbitMQ: 5671) and publish messages to trigger bound Lambda consumers.'