SQS queue is publicly accessible
- Severity
- Medium
- Service
- SQS
- Check ID
- SQS_PUBLIC
What this check finds
This SQS queue's policy allows access from anyone, not only principals in your own account. This may allow an attacker to read or write messages to this queue.
Passing looks like: SQS queues not publicly accessible.
How to fix it
Update the SQS queue policy to remove public access and restrict to specific IAM principals.
AWS CLI
aws sqs set-queue-attributes --queue-url QUEUE_URL --attributes '{"Policy":"JSON_POLICY"}'
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
SQS → Queues → select queue → Access policy → Edit.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| SOC 2 — Trust Services Criteria |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs