rage.fail

aws-sqs-queue-has-policy

explicit aws emits HasPolicy

match (record)

{ "field": "Policy", "resource_type": "AWS::SQS::Queue" }

where

Policy document is present and non-empty

emit

source type	`Queue`
target type	`ResourcePolicy`
source	`<SQS queue node>`
target	`<ResourcePolicy node for the SQS queue>`

Narrative

{queue.name} has an attached resource policy; used by messaging-chains rule 4 to derive cross-account publish-triggered execution.

Raw rule rules/explicit/aws-sqs.yaml

id: aws-sqs-queue-has-policy
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::SQS::Queue
  field: Policy
where:
- Policy document is present and non-empty
emit:
  source_type: Queue
  target_type: ResourcePolicy
  source: <SQS queue node>
  target: <ResourcePolicy node for the SQS queue>
  api_source: sqs:GetQueueAttributes[Policy]
  evidence_field: Policy
  narrative: '{queue.name} has an attached resource policy; used by messaging-chains rule 4 to derive
    cross-account publish-triggered execution.'