🧠 AWS SQS Queue policy allows public access - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 AWS SQS Queue
• 🔌 AWS SQS Queue - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2026-04-25T12:04:02.307488781Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ 300	✔️ otherwise	✔️ null
🟢	test2	✔️ 300	✔️ otherwise	✔️ null
🟢	test3	✔️ 299	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:ReceiveMessage, sqs:SendMessage, sqs:DeleteMessage, ... 2 elements])	✔️ null
🟢	test4	✔️ 199	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:SetQueueAttributes, sqs:DeleteQueue, sqs:AddPermission, ... 4 elements])	✔️ null
🟢	test5	✔️ 199	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:SetQueueAttributes, sqs:DeleteQueue, sqs:AddPermission, ... 4 elements])	✔️ null
🟢	test6	✔️ 199	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:SetQueueAttributes, sqs:DeleteQueue, sqs:AddPermission, ... 4 elements])	✔️ null
🟢	test7	✔️ 299	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:ReceiveMessage, sqs:SendMessage, sqs:DeleteMessage, ... 2 elements])	✔️ null
🟢	test8	✔️ 299	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:ReceiveMessage, sqs:SendMessage, sqs:DeleteMessage, ... 2 elements])	✔️ null
🟢	test9	✔️ 199	✔️ CA10__policyExt__c .allows(EXTERNAL_PRINCIPAL, [sqs:SetQueueAttributes, sqs:DeleteQueue, sqs:AddPermission, ... 4 elements])	✔️ null
🟢	test10	✔️ 300	✔️ otherwise	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/aws/sqs/queue-public-policy/policy.yaml	F2A4166CF383A14F377FCE12BD0D82B9
Open	/ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml	3808D589D6089C13841CC03E0DC0F23B
Open	/ce/ca/aws/sqs/queue-public-policy/test-data.json	D1F5A535A03385B293B3D8669A04732A
Open	/types/CA10__CaAwsQueue__c/object.extracts.yaml	C99AA06C51D1DC9FFE094C4102908EC9

Available Commands

repo-manager policies generate FULL /ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/sqs/queue-public-policy/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaAwsQueue__c"
testData:
  - file: "test-data.json"
importExtracts:
  - file: "/types/CA10__CaAwsQueue__c/object.extracts.yaml"
conditions:
  - status: "INCOMPLIANT"
    currentStateMessage: "The queue policy grants public administrative access to the SQS queue."
    remediationMessage: "Update the queue policy to remove public administrative permissions."
    check:
      AWS_POLICY_ALLOWS:
        policyExtField: "CA10__policyExt__c"
        widestAcceptableAccessLevel: "EXTERNAL_PRINCIPAL"
        actions:
          - "sqs:SetQueueAttributes"
          - "sqs:DeleteQueue"
          - "sqs:AddPermission"
          - "sqs:RemovePermission"
          - "sqs:PurgeQueue"
          - "sqs:TagQueue"
          - "sqs:UntagQueue"
  - status: "INCOMPLIANT"
    currentStateMessage: "The queue policy grants public access to queue messages or metadata."
    remediationMessage: "Update the queue policy to restrict message and metadata access to trusted principals."
    check:
      AWS_POLICY_ALLOWS:
        policyExtField: "CA10__policyExt__c"
        widestAcceptableAccessLevel: "EXTERNAL_PRINCIPAL"
        actions:
          - "sqs:ReceiveMessage"
          - "sqs:SendMessage"
          - "sqs:DeleteMessage"
          - "sqs:ChangeMessageVisibility"
          - "sqs:GetQueueAttributes"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The queue policy does not allow public access."