Policy Packs

guardrails-samples

Ensure that only authorized entities can interact with your SQS queues, reducing the risk of unauthorized access, message tampering, and potential data breaches, while ensuring compliance with security best practices.

Enforce AWS SQS Queues Restrict Access

main

aws_sqs_queue_policy_trusted_access

Take an action when AWS SQS queue policy is not trusted based on the&#92;n`AWS &gt; SQS &gt; Queue &gt; Policy &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the queue policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Accounts,&#92;nTrusted Access &gt; Services etc.), this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nThe account that owns the queue will always be trusted, even if its account ID is&#92;nnot included in the Trusted Accounts policy.&#92;n&#92;nIf set to `Enforce: Revoke untrusted access`, access to non-trusted&#92;nmembers will be removed.&#92;n

queuePolicyTrustedAccess

AWS > SQS > Queue > Policy > Trusted Access

aws_sqs_queue_policy_trusted_access_accounts

List of AWS Account IDs that are trusted for cross-account access in the&#92;nAWS SQS queue policy.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;123456789012&quot;&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all accounts.&#92;n

queuePolicyTrustedAccounts

AWS > SQS > Queue > Policy > Trusted Access > Accounts

aws_sqs_queue_policy_trusted_access_organizations

List of AWS Organization IDs that are trusted for cross-account access in&#92;nthe AWS SQS queue policy, or &#39;*&#39; to skip the Organization Restriction.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n**Note**: `Trusted Access &gt; Organization Restrictions` are ONLY&#92;napplied to AWS principals.  Services and Federated principals do&#92;nNOT contain the `aws:PrincipalOrgId` condition key, and thus&#92;ncannot be validated against the Organization.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;o-333333333&quot;&#92;n  - &quot;o-c3a5y4wd52&quot;&#92;n```&#92;n

queuePolicyTrustedOrganizations

AWS > SQS > Queue > Policy > Trusted Access > Organization Restrictions

aws_sqs_queue_policy_trusted_access_services

List of AWS Services that are trusted for access in the AWS SQS queue policy.&#92;n&#92;n```&#92;nexample:&#92;n  - sns.amazonaws.com&#92;n  - ec2.amazonaws.com&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all services.&#92;n

Policy	Setting	Note
AWS > SQS > Queue > Policy > Trusted Access	Check: Trusted Access
AWS > SQS > Queue > Policy > Trusted Access > Accounts	- "123456789012" - "123456789013"
AWS > SQS > Queue > Policy > Trusted Access > Organization Restrictions	- "o-a3333333333" - "o-c3a5y4wd45"
AWS > SQS > Queue > Policy > Trusted Access > Services	- "sns.amazonaws.com" - "ec2.amazonaws.com"

Policy Settings