rage.fail

aws-sqs-set-queue-attributes

explicit aws emits CanModifyPolicy

match (effective permission)

{ "action": "sqs:SetQueueAttributes", "resource_type": "AWS::SQS::Queue" }

emit

source type	`Identity`
target type	`ResourcePolicy`
source	`<principal>`
target	`<ResourcePolicy node attached to the SQS queue>`
permissions	`sqs:SetQueueAttributes`
conditions	`iam_permission`

Narrative

{principal.name} can rewrite the resource policy of {queue.name} (sqs:SetQueueAttributes).

Raw rule rules/explicit/aws-sqs.yaml

id: aws-sqs-set-queue-attributes
emits: CanModifyPolicy
applies_to:
- aws
match_effective_permission:
  action: sqs:SetQueueAttributes
  resource_type: AWS::SQS::Queue
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: <principal>
  target: <ResourcePolicy node attached to the SQS queue>
  permissions:
  - sqs:SetQueueAttributes
  conditions:
  - iam_permission
  narrative: '{principal.name} can rewrite the resource policy of {queue.name} (sqs:SetQueueAttributes).'