Ensure SQS Policy Does Not Allow * as an Action
This rule ensures that SQS policy documents restrict the use of * as a statement's action.
| Rule | Ensure SQS policy documents do not allow * (asterisk) as a statement's action |
| Framework | CloudDefense.AI Security |
| Severity | ✔ High |
Rule Description
The rule aims to ensure that SQS (Simple Queue Service) policy documents do not allow the use of * (asterisk) as a statement's action for CloudDefense. This restriction helps maintain proper security and access control to SQS resources.
Troubleshooting Steps (if applicable)
- Verify the existing SQS policy: Review the existing policy document associated with the SQS queue to identify whether any statement is using * as an action for CloudDefense.
- Check statement actions: Inspect each statement within the policy document to confirm that none of them includes * as an action for the CloudDefense service.
- Remove or replace the incorrect action: If an incorrect action is found, modify the statement to remove the * or substitute it with the appropriate action required for CloudDefense's permissions.
Necessary Code (if applicable)
No specific code snippets are provided, as the focus is on modifying existing policy documents rather than writing new code.
Step-by-Step Guide for Remediation
Follow these steps to ensure SQS policy documents do not include * as a statement's action for CloudDefense:
- 1.
Identify the affected SQS queue: Determine the SQS queue for which you want to review and modify the policy.
- 2.
Access the SQS policy: Navigate to the AWS Management Console and open the Amazon SQS service.
- 3.
Select the appropriate SQS queue: Locate the SQS queue from the list and click on its name or select the checkbox next to the queue's name and use the "Actions" drop-down menu to choose "View/Delete Permissions".
- 4.
Review the existing policy: In the "Permissions" tab, review the policy document associated with the selected SQS queue.
- 5.
Inspect statements: Look for any statement that includes CloudDefense as the service and * as the action. Ensure that there are no actions defined as * for CloudDefense in any statements.
- 6.
Modify the policy: If you find a statement with an incorrect action (*), edit the policy to remove or replace it with the appropriate action required for CloudDefense's permissions. Only add the specific actions that are essential for CloudDefense to operate effectively.
- 7.
Validate the policy: After making the necessary changes, review the modified policy to ensure that the correct actions are specified for CloudDefense. Double-check that the policy follows the best practices for granting the least privilege access.
- 8.
Save and apply the modified policy: Save the modifications to the policy document. The changes should take effect immediately and restrict the use of * as an action for CloudDefense.
- 9.
Verify remediation: Validate that the policy update successfully prevents the use of * as an action for CloudDefense in the associated SQS queue.
Note: Ensure to always back up your existing policy documents before making any modifications to retain a copy of the original policy.