Description:

This check verifies that Amazon SQS queue policies do not allow public access. Queue policies should only grant permissions to authorized AWS accounts, IAM users, IAM roles, or AWS services. Public access through unrestricted principals can expose queue contents and operations to unauthorized entities.


Rationale:

Amazon SQS queues often contain application, business, or operational messages. If a queue policy allows public access, unauthorized users may send, receive, delete, or inspect messages. Restricting access to specific principals helps enforce the principle of least privilege and protects sensitive data from unauthorized access.


Impact:

  • Unauthorized users may gain access to queue messages.

  • Malicious actors may inject messages into the queue.

  • Critical messages may be deleted or consumed by unauthorized entities.

  • Increased AWS costs due to misuse of queue resources.

  • Potential compliance and security policy violations.


Default Value:

By default, Amazon SQS queues are private and accessible only by the owning AWS account unless additional resource-based policies are explicitly configured.


Remediation:

Test Plan:

Using AWS Console

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon SQS.

  3. Select the target queue.

  4. Click Edit.

  5. Scroll to the Access Policy section.

  6. Review the queue policy for:

    • "Principal": "*"

    • Statements granting access to all users.

    • Overly permissive actions such as:

      • sqs:SendMessage

      • sqs:ReceiveMessage

      • sqs:DeleteMessage

      • sqs:*

  7. Verify that access is granted only to approved AWS principals.


Using AWS CLI:

Retrieve Queue URL

aws sqs get-queue-url \
--queue-name <QUEUE_NAME>

Review Queue Policy

aws sqs get-queue-attributes \
--queue-url <QUEUE_URL> \
--attribute-names Policy

The returned policy should not contain:

"Principal": "*"

Unless accompanied by restrictive conditions that explicitly limit access to trusted entities.


Implementation steps:

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon SQS.

  3. Select the affected queue.

  4. Click Edit.

  5. Locate the Access Policy section.

  6. Remove any statements containing:

"Principal": "*"

  1. Replace them with explicit AWS principals.

Example:

{

 "Effect": "Allow",

 "Principal": {

   "AWS": "arn:aws:iam::123456789012:role/ApplicationRole"

 },

 "Action": [

   "sqs:SendMessage",

   "sqs:ReceiveMessage"

 ],

 "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"

}

  1. Save the policy changes.


Using AWS CLI:

Step 1: Export Existing Policy (Backup)

aws sqs get-queue-attributes \
--queue-url <QUEUE_URL> \
--attribute-names Policy

Save the output for rollback purposes.

Step 2: Create Updated Policy File

Example sqs-policy.json

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "AllowApplicationAccess",
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::123456789012:role/ApplicationRole"
     },
     "Action": [
       "sqs:SendMessage",
       "sqs:ReceiveMessage"
     ],
     "Resource": "arn:aws:sqs:us-east-1:123456789012:MyQueue"
   }
 ]
}

Step 3: Apply Updated Policy

aws sqs set-queue-attributes \
--queue-url <QUEUE_URL> \
--attributes Policy="$(cat sqs-policy.json)"

Step 4: Verify Configuration

aws sqs get-queue-attributes \
--queue-url <QUEUE_URL> \
--attribute-names Policy

Confirm public access has been removed.


Backout Plan:

Using AWS Console:

  1. Navigate to the affected SQS queue.

  2. Select Edit.

  3. Restore the previously documented queue policy.

  4. Save the changes.

  5. Verify application functionality and queue operations.


Using AWS CLI:

Restore the previously backed-up policy:

aws sqs set-queue-attributes \
--queue-url <QUEUE_URL> \
--attributes Policy='PASTE_PREVIOUS_POLICY_JSON'

Verify restoration:

aws sqs get-queue-attributes \
--queue-url <QUEUE_URL> \
--attribute-names Policy


References: