SQS Queues Should Not Allow Cross Account Access

More Info:

AWS SQS queues should be configured to allow access only to trusted. AWS accounts in order to protect against unauthorized cross account entities.

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate this issue, you need to modify the permissions for the SQS queue to disallow cross-account access. Follow these steps:

1. Log in to the AWS Management Console and open the Amazon SQS console at https://console.aws.amazon.com/sqs/.

2. In the navigation pane, choose “Queues”.

3. In the list of queues, choose the name of the queue you want to modify.

4. Choose the “Permissions” tab.

5. You will see a list of all the permissions currently set for this queue. Look for any permissions that allow cross-account access. These will be permissions where the AWS account ID specified is not the same as your own account ID.

6. To delete a permission, choose the “Remove” button next to it. Confirm the deletion when prompted.

7. Repeat this process for all permissions that allow cross-account access.

8. Once done, check the permissions list to ensure there are no longer any permissions allowing cross-account access.

9. If you need to allow specific accounts to access your queue, you can add those permissions back individually, specifying the exact AWS account ID for each account you want to allow.

10. Make sure to review your changes and save them.

Remember, it’s important to regularly review the permissions of your AWS resources to ensure they are configured correctly and securely.

Using CLI

To remediate this misconfiguration, you need to modify the SQS policy to restrict access to the specific AWS accounts that need access to the queue. Here are the steps:

1. First, you need to identify the queue URL. You can list all the SQS queues in your AWS account with the following command:

aws sqs list-queues

2. Once you’ve identified the queue URL, you can retrieve the current policy:

aws sqs get-queue-attributes --queue-url [QUEUE_URL] --attribute-names All

Replace [QUEUE_URL] with your queue URL.

3. Save the output of the above command to a JSON file, for example, policy.json.

4. Edit the policy.json file to remove the cross-account access. The policy should look something like this:

{
    "Version": "2012-10-17",
    "Id": "sqspolicy",
    "Statement": [
        {
            "Sid": "First",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<your-account-id>:root"
            },
            "Action": "SQS:*",
            "Resource": "arn:aws:sqs:<region>:<your-account-id>:<queue-name>"
        }
    ]
}

Replace <your-account-id>, <region>, and <queue-name> with your account ID, the AWS region, and the queue name respectively.

5. Now, set the new policy to the SQS queue:

aws sqs set-queue-attributes --queue-url [QUEUE_URL] --attributes file://policy.json

Replace [QUEUE_URL] with your queue URL.

6. Confirm the changes by retrieving the queue attributes again:

aws sqs get-queue-attributes --queue-url [QUEUE_URL] --attribute-names All

Replace [QUEUE_URL] with your queue URL.

The output should reflect the changes you made to the policy. Now the SQS queue should not allow cross-account access.

Using Python

To remediate the misconfiguration where SQS Queues allow cross-account access, you would need to modify the resource policy attached to the queue. Here are the steps to follow using Python and Boto3, the AWS SDK for Python:

1. Install the Boto3 module for Python - If you haven’t already, you would need to install the Boto3 module for Python. You can do this using pip:

   pip install boto3
   

2. Set up AWS Credentials - Boto3 needs your AWS credentials (Access Key ID and Secret Access Key) to interact with AWS services. You can set these in several ways:

   • Setting environment variables:

     export AWS_ACCESS_KEY_ID="your-access-key-id"
     export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
     

   • Using a credentials file at ~/.aws/credentials, which should look like:

     [default]
     aws_access_key_id = YOUR_ACCESS_KEY
     aws_secret_access_key = YOUR_SECRET_KEY
     

3. Create a Python script - Now, you can create a Python script to modify the resource policy of the SQS queue:

   import boto3
   
   # Create SQS client
   sqs = boto3.client('sqs')
   
   # Specify the URL of your SQS queue
   queue_url = 'SQS_QUEUE_URL'
   
   # Get the current policy
   current_policy = sqs.get_queue_attributes(
       QueueUrl=queue_url,
       AttributeNames=[
           'Policy'
       ]
   )
   
   # Modify the policy to remove cross-account access
   # This step depends on the specifics of your policy. You need to remove any statements from the policy that grant permissions to other AWS accounts.
   
   modified_policy = MODIFY_CURRENT_POLICY_TO_REMOVE_CROSS_ACCOUNT_ACCESS
   
   # Set the modified policy
   sqs.set_queue_attributes(
       QueueUrl=queue_url,
       Attributes={
           'Policy': modified_policy
       }
   )
   

Please note that the MODIFY_CURRENT_POLICY_TO_REMOVE_CROSS_ACCOUNT_ACCESS placeholder in the script needs to be replaced with the actual logic to modify the policy, which depends on the specifics of the current policy.

Also, be aware that modifying the policy in a way that removes necessary permissions can break the functionality of applications that depend on this SQS queue. Always make sure to understand the implications of policy changes before applying them.

Using Terraform

resource "aws_sqs_queue" "this" {
  name = "QUEUE_NAME" # replace with your queue name
}

data "aws_iam_policy_document" "sqs_queue" {
  # Keep only trusted AWS principals here.
  # Remove any untrusted or wildcard principals ('*') to prevent cross-account access.
  statement {
    sid     = "AllowTrustedAccountAccess"
    effect  = "Allow"

    principals {
      type        = "AWS"
      identifiers = [
        "arn:aws:iam::TRUSTED_ACCOUNT_ID:root", # replace with trusted account ID(s)
        # add more trusted principal ARNs as needed
      ]
    }

    actions = [
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes",
      # include only the actions your trusted principals actually need
    ]

    resources = [
      aws_sqs_queue.this.arn,
    ]
  }

  # Add additional statements here only for trusted principals (same or other trusted accounts).
}

resource "aws_sqs_queue_policy" "this" {
  queue_url = aws_sqs_queue.this.id
  policy    = data.aws_iam_policy_document.sqs_queue.json
}

Applying this updates (overwrites) the SQS queue policy; it does not replace the queue itself, but any existing statements (including cross-account ones) that you do not recreate in aws_iam_policy_document will be removed. terraform plan should show an update to aws_sqs_queue_policy.this with the old policy JSON being replaced by the new one that excludes the cross-account principals.

Additional Reading:

• https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-basic-examples-of-sqs-policies.html