Description

Detects Amazon SQS queues that are configured with public access in CloudFormation templates. Public SQS queues can allow unauthorized users to send or receive messages, potentially exposing sensitive data or enabling denial of service attacks.

Detection Strategy

• Identifies CloudFormation resources of type AWS::SQS::Queue or AWS::SQS::QueuePolicy

• Analyzes queue policy statements and access controls to check for public access permissions

• Reports a vulnerability if the queue policy allows access from all principals ('*') or contains overly permissive actions

Vulnerable code example

Resources:
  MyQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: my-queue
      PolicyDocument:
        Version: 2012-10-17
        Statement:...

✅ Secure code example

Resources:
  MyQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: my-queue

  MyQueuePolicy:
    Type: AWS::SQS::QueuePolicy  # Separate policy resource for better management...