rage.fail

aws-sqs-receive-message

explicit aws emits CanReadData

match (effective permission)

{ "action": "sqs:ReceiveMessage", "resource_type": "AWS::SQS::Queue" }

emit

source type	`Identity`
target type	`Queue`
source	`<principal>`
target	`<SQS queue node>`
permissions	`sqs:ReceiveMessage`
conditions	`iam_permission` `resource_policy` `key_permission`
state logic	ACTIVE when effective sqs:ReceiveMessage granted and either no SSE-KMS is configured (AWS-managed SSE-SQS or no encryption) or the principal also holds kms:Decrypt on the CMK. CONDITIONAL(key_permission) when SSE-KMS is configured with a customer CMK and kms:Decrypt on that CMK is not confirmed.

Narrative

{principal.name} can receive messages from {queue.name} (sqs:ReceiveMessage).

Raw rule rules/explicit/aws-sqs.yaml

id: aws-sqs-receive-message
emits: CanReadData
applies_to:
- aws
match_effective_permission:
  action: sqs:ReceiveMessage
  resource_type: AWS::SQS::Queue
emit:
  source_type: Identity
  target_type: Queue
  source: <principal>
  target: <SQS queue node>
  permissions:
  - sqs:ReceiveMessage
  conditions:
  - iam_permission
  - resource_policy
  - key_permission
  state_logic: ACTIVE when effective sqs:ReceiveMessage granted and either no SSE-KMS is configured (AWS-managed
    SSE-SQS or no encryption) or the principal also holds kms:Decrypt on the CMK. CONDITIONAL(key_permission)
    when SSE-KMS is configured with a customer CMK and kms:Decrypt on that CMK is not confirmed.
  narrative: '{principal.name} can receive messages from {queue.name} (sqs:ReceiveMessage).'