aws-sqs-send-message-can-write-data

id: aws-sqs-send-message-can-write-data
emits: CanWriteData
description: 'sqs:SendMessage on a queue is a data-plane publish: the principal can send attacker-influenced
  messages that drive event-source consumers. Consumed by messaging-chains.'
match:
- match_effective_permission:
    action: sqs:SendMessage
    resource_type: AWS::SQS::Queue
emit:
  source_type: Identity
  target_type: Queue
  source: <principal>
  target: <SQS queue node>
  permissions:
  - sqs:SendMessage
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when effective sqs:SendMessage is granted (identity policy + queue resource policy
    both allow; no SCP/boundary denies). CONDITIONAL(resource_policy) when a resource-policy condition
    (aws:SourceArn, aws:SourceAccount) is present that the calling principal must satisfy. BLOCKED by
    SCP or explicit deny in the queue policy.
  confidence: 0.97
  derived_from:
  - aws-sqs-send-message (explicit)
  false_positive_note: 'Both the caller''s identity policy AND the queue resource policy must allow the
    action (cross-account sends require both). Honor resource-policy conditions: aws:SourceArn-scoped
    grants are CONDITIONAL(condition_expression). A SQS FIFO queue additionally requires sqs:SendMessage
    with the MessageGroupId parameter; absence of MessageGroupId does not affect the capability but may
    constrain the attacker''s payload structure.'
  narrative: '{principal.name} can send messages to SQS queue {queue.name} (sqs:SendMessage), enabling
    the Phase-10 trigger chain when {queue.name} is an event source for a compute consumer.'