---
title: SQS policy with public access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > SQS policy with public access
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# SQS policy with public access

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `terraform-aws-sqs-policy-with-public-access` 

**Provider:** AWS

**Platform:** Terraform

**Severity:** Medium

**Category:** Access Control

#### Learn More{% #learn-more %}

- [Provider Reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy)

### Description{% #description %}

This check looks for overly permissive `Action` statements and wildcards `"Principal": "*"` in AWS SQS queue policies, which may grant broad permissions to any user. If left unaddressed, this misconfiguration can allow unauthorized parties to perform any action on the queue, including viewing, deleting, or sending messages, which poses risks such as data leakage or denial of service. To reduce the attack surface, always scope the `Principal` attribute in policy documents to trusted AWS identities instead of using `"*"` or `{"AWS": "*"}`.

The following is an example of an insecure configuration:

```
resource "aws_sqs_queue_policy" "test" {
  ...
  policy = <<EOF
{
  "Statement": [{
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:*:111122223333:queue1"
  }]
}
EOF
}
```

A secure configuration uses a more restrictive principal, as shown below:

```
resource "aws_sqs_queue_policy" "test" {
  ...
  policy = <<EOF
{
  "Statement": [{
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::111122223333:user/TrustedUser"},
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:*:111122223333:queue1"
  }]
}
EOF
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```terraform
resource "aws_sqs_queue" "q" {
  name = "examplequeue"
}

resource "aws_sqs_queue_policy" "test" {
  queue_url = aws_sqs_queue.q.id

  policy = <<POLICY
{
   "Version": "2012-10-17",
   "Id": "Queue1_Policy_UUID",
   "Statement": [{
      "Sid":"Queue1_AnonymousAccess_AllActions_AllowlistIP",
      "Effect": "Allow",
      "Principal": "SOMETHING",
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:*:111122223333:queue1",
      "Condition" : {
         "IpAddress" : {
            "aws:SourceIp":"192.168.143.0/24"
         }
      }
   }]
}
POLICY
}
```

```terraform
# Plan-JSON counterpart of negative.tf for the module-input path: the
# policy's principal is a specific account root ARN, not a wildcard. See
# negative2.json and the second module-scoped rule body in query.rego.
module "sqs_queue_policy" {
  source  = "terraform-aws-modules/sqs/aws"
  version = "~> 2.0"

  name = "example"
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Id": "sqspolicy",
  "Statement": [
    {
      "Sid": "First",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:eu-west-1:135367859851:queue1",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:eu-west-1:135367859851:rule/RunDailyTask"
        }
      }
    }
  ]
}
POLICY

  # ... other configuration ...
}
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```terraform
resource "aws_sqs_queue" "q" {
  name = "examplequeue"
}

resource "aws_sqs_queue_policy" "test" {
  queue_url = aws_sqs_queue.q.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Id": "Queue1_Policy_UUID",
  "Statement": [{
      "Sid":"Queue1_AnonymousAccess_AllActions_AllowlistIP",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:*:111122223333:queue1",
      "Condition" : {
        "IpAddress" : {
            "aws:SourceIp":"192.168.143.0/24"
        }
      }
  }]
}
EOF
}

resource "aws_sqs_queue" "q_aws_array" {
  name = "examplequeue_aws_array"
}

resource "aws_sqs_queue" "q_aws" {
  name = "examplequeue_aws"
}

resource "aws_sqs_queue_policy" "test_aws" {
  queue_url = aws_sqs_queue.q_aws.id

  policy = <<EOF
{
   "Version": "2012-10-17",
   "Id": "Queue1_Policy_UUID",
   "Statement": [{
      "Sid":"Queue1_AnonymousAccess_AllActions_AllowlistIP",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:*:111122223333:queue1",
      "Condition" : {
         "IpAddress" : {
            "aws:SourceIp":"192.168.143.0/24"
         }
      }
   }]
}
EOF
}

resource "aws_sqs_queue_policy" "test_aws_array" {
  queue_url = aws_sqs_queue.q_aws_array.id

  policy = <<EOF
{
   "Version": "2012-10-17",
   "Id": "Queue1_Policy_UUID",
   "Statement": [{
      "Sid":"Queue1_AnonymousAccess_AllActions_AllowlistIP",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["*"]
      },
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:*:111122223333:queue1",
      "Condition" : {
         "IpAddress" : {
            "aws:SourceIp":"192.168.143.0/24"
         }
      }
   }]
}
EOF
}
```

```terraform
resource "aws_sqs_queue" "multi" {
  name = "multi-statement-queue"
}

resource "aws_sqs_queue_policy" "multi" {
  queue_url = aws_sqs_queue.multi.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Id": "MultiStatementPolicy",
  "Statement": [
    {
      "Sid": "AllowSpecific",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:multi-statement-queue"
    },
    {
      "Sid": "AllowAnyone",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:multi-statement-queue"
    }
  ]
}
EOF
}
```

```terraform
# A wildcard-principal policy passed as a literal module input argument.
# input.document[i].module[name] (used by the first module-scoped rule body)
# is never populated by the plan-JSON parser, but the module call's own
# input arguments still survive unmodified under
# configuration.root_module.module_calls[name].expressions -- see
# positive3.json (a real plan for this exact configuration) and the second
# module-scoped rule body in query.rego that reads from there instead.
module "sqs_queue_policy" {
  source  = "terraform-aws-modules/sqs/aws"
  version = "~> 2.0"

  name = "example"
  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Id": "sqspolicy",
  "Statement": [
    {
      "Sid": "First",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:eu-west-1:135367859851:queue1",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:eu-west-1:135367859851:rule/RunDailyTask"
        }
      }
    }
  ]
}
POLICY

  # ... other configuration ...
}
```