​
Triage and Remediation

​
Remediation

Using Console

To remediate this issue, you need to modify the permissions for the SQS queue to disallow cross-account access. Follow these steps:
  1. Log in to the AWS Management Console and open the Amazon SQS console at https://console.aws.amazon.com/sqs/.
  2. In the navigation pane, choose “Queues”.
  3. In the list of queues, choose the name of the queue you want to modify.
  4. Choose the “Permissions” tab.
  5. You will see a list of all the permissions currently set for this queue. Look for any permissions that allow cross-account access. These will be permissions where the AWS account ID specified is not the same as your own account ID.
  6. To delete a permission, choose the “Remove” button next to it. Confirm the deletion when prompted.
  7. Repeat this process for all permissions that allow cross-account access.
  8. Once done, check the permissions list to ensure there are no longer any permissions allowing cross-account access.
  9. If you need to allow specific accounts to access your queue, you can add those permissions back individually, specifying the exact AWS account ID for each account you want to allow.
  10. Make sure to review your changes and save them.
Remember, it’s important to regularly review the permissions of your AWS resources to ensure they are configured correctly and securely.
To remediate this misconfiguration, you need to modify the SQS policy to restrict access to the specific AWS accounts that need access to the queue. Here are the steps:
  1. First, you need to identify the queue URL. You can list all the SQS queues in your AWS account with the following command:
aws sqs list-queues
  1. Once you’ve identified the queue URL, you can retrieve the current policy:
aws sqs get-queue-attributes --queue-url [QUEUE_URL] --attribute-names All
Replace [QUEUE_URL] with your queue URL.
  1. Save the output of the above command to a JSON file, for example, policy.json.
  2. Edit the policy.json file to remove the cross-account access. The policy should look something like this: 
{
    "Version": "2012-10-17",
    "Id": "sqspolicy",
    "Statement": [
        {
            "Sid": "First",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<your-account-id>:root"
            },
            "Action": "SQS:*",
            "Resource": "arn:aws:sqs:<region>:<your-account-id>:<queue-name>"
        }
    ]
}
Replace <your-account-id>, <region>, and <queue-name> with your account ID, the AWS region, and the queue name respectively.
  1. Now, set the new policy to the SQS queue:
aws sqs set-queue-attributes --queue-url [QUEUE_URL] --attributes file://policy.json
Replace [QUEUE_URL] with your queue URL.
  1. Confirm the changes by retrieving the queue attributes again:
aws sqs get-queue-attributes --queue-url [QUEUE_URL] --attribute-names All
Replace [QUEUE_URL] with your queue URL.The output should reflect the changes you made to the policy. Now the SQS queue should not allow cross-account access.
To remediate the misconfiguration where SQS Queues allow cross-account access, you would need to modify the resource policy attached to the queue. Here are the steps to follow using Python and Boto3, the AWS SDK for Python:
  1. Install the Boto3 module for Python - If you haven’t already, you would need to install the Boto3 module for Python. You can do this using pip: 
    pip install boto3
  2. Set up AWS Credentials - Boto3 needs your AWS credentials (Access Key ID and Secret Access Key) to interact with AWS services. You can set these in several ways:
    • Setting environment variables: 
      export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
    • Using a credentials file at ~/.aws/credentials, which should look like: 
      [default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
  3. Create a Python script - Now, you can create a Python script to modify the resource policy of the SQS queue: 
    import boto3

# Create SQS client
sqs = boto3.client('sqs')

# Specify the URL of your SQS queue
queue_url = 'SQS_QUEUE_URL'

# Get the current policy
current_policy = sqs.get_queue_attributes(
    QueueUrl=queue_url,
    AttributeNames=[
        'Policy'
    ]
)

# Modify the policy to remove cross-account access
# This step depends on the specifics of your policy. You need to remove any statements from the policy that grant permissions to other AWS accounts.

modified_policy = MODIFY_CURRENT_POLICY_TO_REMOVE_CROSS_ACCOUNT_ACCESS

# Set the modified policy
sqs.set_queue_attributes(
    QueueUrl=queue_url,
    Attributes={
        'Policy': modified_policy
    }
)
Please note that the MODIFY_CURRENT_POLICY_TO_REMOVE_CROSS_ACCOUNT_ACCESS placeholder in the script needs to be replaced with the actual logic to modify the policy, which depends on the specifics of the current policy.Also, be aware that modifying the policy in a way that removes necessary permissions can break the functionality of applications that depend on this SQS queue. Always make sure to understand the implications of policy changes before applying them.