steampipe plugin install awssteampipe plugin install aws

Table: aws_sqs_queue

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables to decouple and scale micro services, distributed systems, and serverless applications

Examples

Basic info

select
  title,
  delay_seconds,
  max_message_size,
  receive_wait_time_seconds,
  message_retention_seconds,
  visibility_timeout_seconds
from
  aws_sqs_queue;

List unencrypted queues

select
  title,
  kms_master_key_id,
  sqs_managed_sse_enabled
from
  aws_sqs_queue
where
  kms_master_key_id is null
  and not sqs_managed_sse_enabled;

List queues encrypted with a CMK

select
  title,
  kms_master_key_id,
  sqs_managed_sse_enabled
from
  aws_sqs_queue
where
  kms_master_key_id is not null;

List queues encrypted with an SQS-owned encryption key

select
  title,
  kms_master_key_id,
  sqs_managed_sse_enabled
from
  aws_sqs_queue
where
  sqs_managed_sse_enabled;

List queues with a message retention period less than 7 days

select
  title,
  message_retention_seconds
from
  aws_sqs_queue
where
  message_retention_seconds < '604800';

List queues which are not configured with a dead-letter queue (DLQ)

select
  title,
  redrive_policy
from
  aws_sqs_queue
where
  redrive_policy is null;

List FIFO queues

select
  title,
  fifo_queue
from
  aws_sqs_queue
where
  fifo_queue;

List queues with policy statements that grant cross-account access

select
  title,
  p as principal,
  a as action,
  s ->> 'Effect' as effect,
  s -> 'Condition' as conditions
from
  aws_sqs_queue,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  string_to_array(p, ':') as pa,
  jsonb_array_elements_text(s -> 'Action') as a
where
  s ->> 'Effect' = 'Allow'
  and (
    pa [ 5 ] != account_id
    or p = '*'
  );

List queues with policy statements that grant anoymous access

select
  title,
  p as principal,
  a as action,
  s ->> 'Effect' as effect,
  s -> 'Condition' as conditions
from
  aws_sqs_queue,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  jsonb_array_elements_text(s -> 'Action') as a
where
  p = '*'
  and s ->> 'Effect' = 'Allow';

List queues with policy statements that grant full access (sqs:*)

select
  title,
  p as principal,
  a as action,
  s ->> 'Effect' as effect,
  s -> 'Condition' as conditions
from
  aws_sqs_queue,
  jsonb_array_elements(policy_std -> 'Statement') as s,
  jsonb_array_elements_text(s -> 'Principal' -> 'AWS') as p,
  jsonb_array_elements_text(s -> 'Action') as a
where
  s ->> 'Effect' = 'Allow'
  and a in ('*', 'sqs:*');

Query examples

Control examples

.inspect aws_sqs_queue

AWS SQS Queue

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
content_based_deduplication	text	Mentions whether content-based deduplication is enabled for the queue.
deduplication_scope	text	Specifies whether message deduplication occurs at the message group or queue level.
delay_seconds	text	The default delay on the queue in seconds.
fifo_queue	boolean	Returns true if the queue is FIFO.
fifo_throughput_limit	text	Specifies whether the FIFO queue throughput quota applies to the entire queue or per message group.
kms_master_key_id	text	The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK.
max_message_size	text	The limit of how many bytes a message can contain before Amazon SQS rejects it.
message_retention_seconds	text	The length of time, in seconds, for which Amazon SQS retains a message.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy	jsonb	The resource IAM policy of the queue.
policy_std	jsonb	Contains the policy in a canonical form for easier searching.
queue_arn	text	The Amazon resource name (ARN) of the queue.
queue_url	text	The URL of the Amazon SQS queue.
receive_wait_time_seconds	text	The length of time, in seconds, for which the ReceiveMessage action waits for a message to arrive.
redrive_policy	jsonb	The string that includes the parameters for the dead-letter queue functionality of the source queue as a JSON object.
region	text	The AWS Region in which the resource is located.
sqs_managed_sse_enabled	boolean	Returns true if the queue is using SSE-SQS encryption with SQS-owned encryption keys.
tags	jsonb	A map of tags for the resource.
title	text	Title of the resource.
visibility_timeout_seconds	text	The visibility timeout for the queue in seconds.

turbot/aws