rage.fail

aws-sqs-public-send-policy

explicit aws emits ExposedToInternet

match (record)

{ "field": "Policy", "resource_type": "AWS::SQS::Queue" }

where

statement Action includes sqs:SendMessage or sqs:* statement Principal is * or {"AWS":"*"} statement Effect == Allow statement has no effective restricting condition

emit

source type	`Queue`
target type	`AnonymousIdentity`
source	`<SQS queue node>`
target	`<AnonymousIdentity>`
conditions	`resource_policy`

Narrative

{queue.name} grants sqs:SendMessage to Principal:* with no condition; publicly writable by any unauthenticated caller.

Raw rule rules/explicit/aws-sqs.yaml

id: aws-sqs-public-send-policy
emits: ExposedToInternet
applies_to:
- aws
match_record:
  resource_type: AWS::SQS::Queue
  field: Policy
where:
- statement Action includes sqs:SendMessage or sqs:*
- statement Principal is * or {"AWS":"*"}
- statement Effect == Allow
- statement has no effective restricting condition
emit:
  source_type: Queue
  target_type: AnonymousIdentity
  source: <SQS queue node>
  target: <AnonymousIdentity>
  api_source: sqs:GetQueueAttributes[Policy]
  evidence_field: Policy.Statement[].Principal, Action, Condition
  conditions:
  - resource_policy
  narrative: '{queue.name} grants sqs:SendMessage to Principal:* with no condition; publicly writable
    by any unauthenticated caller.'