aws-sqs-cross-account-send-trust

A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.

derived aws emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`ResourcePolicy`
target type	`Account`
source	`<queue ResourcePolicy node>`
target	`<external account named in the policy statement>`
conditions	`resource_policy` `condition_expression`
state logic	ACTIVE when the policy statement unconditionally grants sqs:SendMessage to a named external principal (specific account root or role ARN, no restricting condition). CONDITIONAL(condition_expression) when the grant is scoped by aws:SourceArn, aws:SourceAccount, or aws:PrincipalOrgID — the external principal must satisfy the condition to publish. BLOCKED by an SCP that denies cross-account access or by an org-policy restricting external sharing. An aws:PrincipalOrgID condition that covers the queue's own org is NOT cross-account in the external sense; downgrade to ExposedToAccount.

source type

ResourcePolicy

target type

Account

source

<queue ResourcePolicy node>

target

<external account named in the policy statement>

conditions

resource_policy condition_expression

state logic

ACTIVE when the policy statement unconditionally grants sqs:SendMessage to a named external principal (specific account root or role ARN, no restricting condition). CONDITIONAL(condition_expression) when the grant is scoped by aws:SourceArn, aws:SourceAccount, or aws:PrincipalOrgID — the external principal must satisfy the condition to publish. BLOCKED by an SCP that denies cross-account access or by an org-policy restricting external sharing. An aws:PrincipalOrgID condition that covers the queue's own org is NOT cross-account in the external sense; downgrade to ExposedToAccount.

Narrative

The resource policy on SQS queue {queue.name} grants sqs:SendMessage to a principal in account {external_account}; this cross-account trust lets that external principal publish to {queue.name} and thereby (via messaging-chains) trigger any Lambda consumer bound to it in {queue.owner_account}.

Raw rule rules/derived/aws/sqs.yaml

id: aws-sqs-cross-account-send-trust
emits: CrossAccountTrust
description: A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account
  publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.
match:
- match_record:
    resource_type: AWS::SQS::Queue
    field: Policy
  where:
  - statement grants sqs:SendMessage or sqs:* to Principal in a different account than the queue owner
where:
- node_type(?policy) == ResourcePolicy
emit:
  source_type: ResourcePolicy
  target_type: Account
  source: <queue ResourcePolicy node>
  target: <external account named in the policy statement>
  permissions: []
  conditions:
  - resource_policy
  - condition_expression
  state_logic: "ACTIVE when the policy statement unconditionally grants sqs:SendMessage to a named external\
    \ principal (specific account root or role ARN, no restricting condition). CONDITIONAL(condition_expression)\
    \ when the grant is scoped by aws:SourceArn, aws:SourceAccount, or aws:PrincipalOrgID \u2014 the external\
    \ principal must satisfy the condition to publish. BLOCKED by an SCP that denies cross-account access\
    \ or by an org-policy restricting external sharing. An aws:PrincipalOrgID condition that covers the\
    \ queue's own org is NOT cross-account in the external sense; downgrade to ExposedToAccount."
  confidence: 0.95
  derived_from:
  - aws-sqs-resource-policy-cross-account-send (explicit)
  false_positive_note: "Honor aws:SourceArn/SourceAccount/PrincipalOrgID scoping \u2014 a grant scoped\
    \ to a specific SNS topic ARN (for SNS-to-SQS delivery) is CONDITIONAL, not open cross-account access.\
    \ A Principal:* with no condition is ExposedToInternet (handled separately below), not CrossAccountTrust.\
    \ Do not emit for grants where the external principal account ID equals the queue owner account."
  narrative: The resource policy on SQS queue {queue.name} grants sqs:SendMessage to a principal in account
    {external_account}; this cross-account trust lets that external principal publish to {queue.name}
    and thereby (via messaging-chains) trigger any Lambda consumer bound to it in {queue.owner_account}.