SQS Policy With Public Access

Query id: d994585f-defb-4b51-b6d2-c70f020ceb10
Query name: SQS Policy With Public Access
Platform: Ansible
Severity: Medium
Category: Access Control
CWE: 284
URL: Github

Description¶

Checks for dangerous permissions in Action statements in an SQS Queue Policy. This is deemed a potential security risk as it would allow various attacks to the queue
Documentation

Code samples¶

Code samples with security vulnerabilities¶

Positive test num. 1 - yaml file

- name: First SQS queue with policy
  community.aws.sqs_queue:
    name: my-queue1
    region: ap-southeast-1
    default_visibility_timeout: 120
    message_retention_period: 86400
    maximum_message_size: 1024
    delivery_delay: 30
    receive_message_wait_time: 20
    policy:
      Version: "2012-10-17"
      Statement:
      - Effect: "Allow"
        Action: "sqs:*"
        Resource: "*"
        Principal: "*"
    make_default: false
    state: present
- name: Second SQS queue with policy
  community.aws.sqs_queue:
    name: my-queue2
    region: ap-southeast-3
    default_visibility_timeout: 120
    message_retention_period: 86400
    maximum_message_size: 1024
    delivery_delay: 30
    receive_message_wait_time: 20
    policy:
      Version: "2012-10-17"
      Statement:
      - Effect: "Allow"
        Action: "*"
        Resource: "*"
        Principal:
          AWS: "*"
    make_default: false
    state: present

Code samples without security vulnerabilities¶

Negative test num. 1 - yaml file

- name: First SQS queue with policy
  community.aws.sqs_queue:
    name: my-queue1
    region: ap-southeast-1
    default_visibility_timeout: 120
    message_retention_period: 86400
    maximum_message_size: 1024
    delivery_delay: 30
    receive_message_wait_time: 20
    policy:
      Version: '2012-10-17'
      Statement:
      - Effect: Allow
        Action: sqs:*
        Resource: '*'
        Principal: Principal
    make_default: false
    state: present