Description
An SQS queue policy that grants actions broadly with Principal set to * can allow unnecessary message submission or access. Effective access depends on Action, Resource, conditions, explicit denies and applicable permissions.
Allowing SendMessage does not also grant message reading or deletion. Queues with server-side encryption reject anonymous SendMessage and ReceiveMessage requests, but encryption does not replace appropriate authorization.
Potential impact
- Unwanted messages can disrupt backend processing or increase costs.
- Excessive read or delete permissions can expose message contents or cause processing loss.
Remediation
Restrict Principal, Action and Resource to approved identities, queues and required operations. For SNS delivery, use the sns.amazonaws.com service principal and an aws:SourceArn condition identifying the approved topic. Test that intended producer and consumer requests succeed and unapproved requests are denied.
Examples
The same queue uses a separate policy resource to avoid a self-reference to its ARN. The SNS topic resource is omitted; reference the actual approved topic.
Before
resource "aws_sqs_queue" "app_queue" {
name = "examplequeue"
}
resource "aws_sqs_queue_policy" "app_queue" {
queue_url = aws_sqs_queue.app_queue.id
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "sqs:SendMessage",
"Resource": "${aws_sqs_queue.app_queue.arn}"
}
]
}
POLICY
}
This grants SendMessage to a broad set of principals. That grant alone does not permit reading or deleting messages.
After
resource "aws_sqs_queue" "app_queue" {
name = "examplequeue"
}
resource "aws_sqs_queue_policy" "app_queue" {
queue_url = aws_sqs_queue.app_queue.id
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {"Service": "sns.amazonaws.com"},
"Action": "sqs:SendMessage",
"Resource": "${aws_sqs_queue.app_queue.arn}",
"Condition": {
"ArnEquals": {
"aws:SourceArn": "${aws_sns_topic.notifications.arn}"
}
}
}
]
}
POLICY
}
This limits sending to the SNS service with a specific topic ARN condition. Review other queue policies and related IAM and KMS permissions too.