aws-sqs-receive-message-can-read-data

sqs:ReceiveMessage on a queue is a data-plane read; if the queue carries credentials (ContainsSecret), credential-chains derives CanImpersonate.

derived aws emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

emit

source type	`Identity`
target type	`Queue`
source	`<principal>`
target	`<SQS queue node>`
permissions	`sqs:ReceiveMessage`
conditions	`iam_permission` `resource_policy` `key_permission`
state logic	ACTIVE when effective sqs:ReceiveMessage is granted and (a) no SSE-KMS is configured, or (b) SSE-KMS is configured AND the principal also holds kms:Decrypt on the CMK (key_permission satisfied). CONDITIONAL(key_permission) when SSE-KMS is set and kms:Decrypt on the CMK is not yet confirmed — the messages are delivered encrypted and the principal cannot read them without the key. SSE-SQS (AWS-managed, AES-256) decrypts transparently at the service layer: no additional key permission needed, ACTIVE. BLOCKED by SCP or explicit deny.

source type

Identity

target type

Queue

source

<principal>

target

<SQS queue node>

permissions

sqs:ReceiveMessage

conditions

iam_permission resource_policy key_permission

state logic

ACTIVE when effective sqs:ReceiveMessage is granted and (a) no SSE-KMS is configured, or (b) SSE-KMS is configured AND the principal also holds kms:Decrypt on the CMK (key_permission satisfied). CONDITIONAL(key_permission) when SSE-KMS is set and kms:Decrypt on the CMK is not yet confirmed — the messages are delivered encrypted and the principal cannot read them without the key. SSE-SQS (AWS-managed, AES-256) decrypts transparently at the service layer: no additional key permission needed, ACTIVE. BLOCKED by SCP or explicit deny.

Narrative

{principal.name} can receive messages from SQS queue {queue.name} (sqs:ReceiveMessage){if key_permission: ", and can decrypt SSE-KMS-protected messages (kms:Decrypt on CMK)"}; if {queue.name} carries credential material, credential-chains derives the ability to authenticate as the embedded identity.

Raw rule rules/derived/aws/sqs.yaml

id: aws-sqs-receive-message-can-read-data
emits: CanReadData
description: sqs:ReceiveMessage on a queue is a data-plane read; if the queue carries credentials (ContainsSecret),
  credential-chains derives CanImpersonate.
match:
- match_effective_permission:
    action: sqs:ReceiveMessage
    resource_type: AWS::SQS::Queue
emit:
  source_type: Identity
  target_type: Queue
  source: <principal>
  target: <SQS queue node>
  permissions:
  - sqs:ReceiveMessage
  conditions:
  - iam_permission
  - resource_policy
  - key_permission
  state_logic: "ACTIVE when effective sqs:ReceiveMessage is granted and (a) no SSE-KMS is configured,\
    \ or (b) SSE-KMS is configured AND the principal also holds kms:Decrypt on the CMK (key_permission\
    \ satisfied). CONDITIONAL(key_permission) when SSE-KMS is set and kms:Decrypt on the CMK is not yet\
    \ confirmed \u2014 the messages are delivered encrypted and the principal cannot read them without\
    \ the key. SSE-SQS (AWS-managed, AES-256) decrypts transparently at the service layer: no additional\
    \ key permission needed, ACTIVE. BLOCKED by SCP or explicit deny."
  confidence: 0.95
  derived_from:
  - aws-sqs-receive-message (explicit)
  false_positive_note: "SSE-KMS (KmsMasterKeyId set to a customer CMK, not the AWS-managed alias/aws/sqs)\
    \ requires kms:Decrypt \u2014 do NOT emit ACTIVE without confirming the principal has decrypt permission\
    \ on the specific CMK. AWS-managed SSE-SQS key (alias/aws/sqs) does not require explicit kms:Decrypt\
    \ \u2014 service handles it. sqs:ReceiveMessage alone does not yield escalation; value comes only\
    \ when combined with ContainsSecret/CredentialsFor via credential-chains."
  narrative: '{principal.name} can receive messages from SQS queue {queue.name} (sqs:ReceiveMessage){if
    key_permission: ", and can decrypt SSE-KMS-protected messages (kms:Decrypt on CMK)"}; if {queue.name}
    carries credential material, credential-chains derives the ability to authenticate as the embedded
    identity.'