rage.fail

aws-sqs-resource-policy-cross-account-receive

explicit aws emits CrossAccountTrust

match (record)

{ "field": "Policy", "resource_type": "AWS::SQS::Queue" }

where

statement Action includes sqs:ReceiveMessage or sqs:* statement Principal is an ARN in a different account than the queue owner statement Effect == Allow

emit

source type	`ResourcePolicy`
target type	`Account`
source	`<queue ResourcePolicy node>`
target	`<external account of the named principal>`
conditions	`resource_policy` `condition_expression`
state logic	ACTIVE when no restricting condition. CONDITIONAL(condition_expression) when scoped by aws:SourceArn/SourceAccount/PrincipalOrgID.

Narrative

{queue.name} resource policy grants sqs:ReceiveMessage to {external.name} (account {account}), creating cross-account data-read trust.

Raw rule rules/explicit/aws-sqs.yaml

id: aws-sqs-resource-policy-cross-account-receive
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::SQS::Queue
  field: Policy
where:
- statement Action includes sqs:ReceiveMessage or sqs:*
- statement Principal is an ARN in a different account than the queue owner
- statement Effect == Allow
emit:
  source_type: ResourcePolicy
  target_type: Account
  source: <queue ResourcePolicy node>
  target: <external account of the named principal>
  api_source: sqs:GetQueueAttributes[Policy]
  evidence_field: Policy.Statement[].Principal, Action, Condition
  conditions:
  - resource_policy
  - condition_expression
  state_logic: ACTIVE when no restricting condition. CONDITIONAL(condition_expression) when scoped by
    aws:SourceArn/SourceAccount/PrincipalOrgID.
  narrative: '{queue.name} resource policy grants sqs:ReceiveMessage to {external.name} (account {account}),
    creating cross-account data-read trust.'