SQS policy allows all actions misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_72
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule ensures that AWS SQS policies are configured to limit permissions to specific actions, avoiding the use of unrestricted wildcards like (*), in adherence to the principle of least privilege. By restricting actions to only those necessary for your application, you mitigate the risk of unauthorized access and potential misuse of your SQS queue.

How to Fix

Arguments: aws_sqs_queue_policy

• Attribute: policy.Statement.Action

In the following example, the IAM policy is configured to allow only the sqs:SendMessage action, restricting access to the SQS queue. This helps prevent unauthorized actions and enhances security. [source,go]

resource "aws_sqs_queue_policy" "example" { ...

policy = <<POLICY { ... "Statement": [ { "Sid": "Example", "Effect": "Allow",

• "Action" = "*",
• "Action": ["sqs:SendMessage"], ... } ] } POLICY }

---