Description
An SQS queue inventory documents asynchronous message flows and operational ownership. The presence of a queue is not itself a vulnerability.
Potential impact
Unlisted queues may be missed in reviews of access policies, message retention, and failed-message handling.
Remediation
Record each queue’s owner and services, then check access policies, encryption, retention, and dead-letter queues (DLQs).
Examples
The examples add service and environment tags without editing message-retention or access-policy configuration. Check the effect of any tag-based IAM policies.
Before
hcl
resource "aws_sqs_queue" "jobs" {
name = "jobs-queue"
}
After
hcl
resource "aws_sqs_queue" "jobs" {
name = "jobs-queue"
tags = {
Service = "worker"
Environment = "production"
}
}