aws-sqs-set-queue-attributes-policy

id: aws-sqs-set-queue-attributes-policy
emits: CanModifyPolicy
description: sqs:SetQueueAttributes allows rewriting the queue resource policy (Policy attribute), enabling
  self-grant of sqs:SendMessage and the downstream trigger chain.
match:
- match_effective_permission:
    action: sqs:SetQueueAttributes
    resource_type: AWS::SQS::Queue
where:
- the permission scope includes the Policy attribute (SetQueueAttributes applies to all attributes; no
  per-attribute scope in IAM)
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: <principal>
  target: <ResourcePolicy node attached to the SQS queue>
  permissions:
  - sqs:SetQueueAttributes
  conditions:
  - iam_permission
  state_logic: "ACTIVE when effective sqs:SetQueueAttributes is granted (no SCP or explicit deny). There\
    \ is no IAM condition key that scopes SetQueueAttributes to specific queue attributes \u2014 the permission\
    \ covers all attributes including Policy. BLOCKED by SCP denying the action or by a permission boundary\
    \ excluding it."
  confidence: 0.9
  derived_from:
  - aws-sqs-set-queue-attributes (explicit)
  false_positive_note: "sqs:SetQueueAttributes is an unrestricted attribute-write \u2014 it covers ALL\
    \ queue attributes including the Policy. The downstream escalation (rewrite policy -> grant SendMessage\
    \ -> trigger) requires the attacker also has access to invoke Lambda or that an ESM binding exists;\
    \ the CanModifyPolicy edge alone is not escalation. sqs:AddPermission is a weaker substitute that\
    \ can ONLY add Allow statements and automatically adds aws:SourceAccount-like conditions for service\
    \ principals \u2014 it cannot fully replace SetQueueAttributes for arbitrary policy writes; model\
    \ AddPermission separately if present."
  narrative: '{principal.name} can rewrite the resource policy of SQS queue {queue.name} (sqs:SetQueueAttributes);
    an attacker can self-grant sqs:SendMessage and then trigger any Lambda consumer bound to {queue.name}
    via the Phase-10 trigger chain.'