SQS queue access policies should not allow public access

How to fix it

• Overwrites existing settings: The CLI and Terraform routes replace the whole access policy, so start from the current one and keep the statements you are not changing.
• Can break clients: Anything that reached the queue through the open statement, such as an event notification or a topic subscription, is refused rather than queued once the policy is saved.

In the console

Simple Queue Service → Queues → the queue → Access policy

Principal

Named accounts or services; not "*" or {"AWS": "*"} in an Allow, and no Allow with NotPrincipal

Condition

Keep "*" only with a fixed aws:SourceAccount, aws:PrincipalOrgID or aws:SourceArn; not aws:SourceOwner or aws:SourceIp

With the AWS CLI

aws sqs set-queue-attributes --queue-url <queue-url> --attributes file://queue-attributes.json --region <region>

With Terraform

resource "aws_sqs_queue_policy" "this" {
  queue_url = var.queue_url
  policy    = data.aws_iam_policy_document.no_public_access.json
}