brief

# Lab: `sqs_queue_overbroad_policy`

b2b_saas / medium / `event-messaging` · prod

## Your job

An event queue handles transaction messages. Can unauthorized external parties read or inject the messages in flight?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n02_7994/acct-main`: **Account** prod-account-7994
- `n16_7994/sqs-order-events`: **SqsQueue** order-events-queue-7994
- `n20_7994/s3-order-archive`: **S3Bucket** order-events-archive-7994
- `n07_7994/data-order-events`: **DataSet** order-transaction-payloads-7994
- `n24_7994/s3-status-page`: **S3Bucket** status-page-assets-7994
- `n04_7994/role-batch-service`: **IAMRole** BatchServiceRole-7994
- `n23_7994/pol-batch-service`: **IAMPolicy** BatchServicePolicy-7994
- `n00_7994/role-release-audit`: **IAMRole** ReleaseAuditRole-7994
- `n10_7994/pol-release-audit-read`: **IAMPolicy** ReleaseAuditReadPolicy-7994
- `n17_7994/role-partner-sync`: **IAMRole** PartnerSyncRole-7994
- `n18_7994/pol-partner-sync-read`: **IAMPolicy** PartnerSyncReadPolicy-7994
- `n25_7994/s3-release-downloads`: **S3Bucket** release-downloads-7994
- `n21_7994/s3-ops-runbooks`: **S3Bucket** ops-runbooks-7994
- `n11_7994/trail-ops-runbooks`: **LogTrail** trail-ops-runbooks-7994
- `n05_7994/data-ops-runbooks`: **DataSet** runbook-library-7994
- `n12_7994/s3-audit-evidence`: **S3Bucket** audit-evidence-7994
- `n22_7994/trail-audit-evidence`: **LogTrail** trail-audit-evidence-7994
- `n09_7994/data-audit-evidence`: **DataSet** audit-evidence-files-7994
- `n01_7994/s3-app-config`: **S3Bucket** app-config-store-7994
- `n19_7994/trail-app-config`: **LogTrail** trail-app-config-7994
- `n06_7994/data-app-config`: **DataSet** app-config-values-7994
- `n15_7994/sqs-audit-events`: **SqsQueue** audit-events-7994
- `n14_7994/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-7994
- `n08_7994/sqs-metrics-queue`: **SqsQueue** metrics-queue-7994
- `n13_7994/s3-exports-staging`: **S3Bucket** exports-staging-7994
- `n03_7994/ecr-base-runner`: **EcrRepository** repo-base-runner-7994

## Relationships

- `n02_7994/acct-main` --exposed_to_internet--> `n16_7994/sqs-order-events`
- `n20_7994/s3-order-archive` --stores_sensitive_data--> `n07_7994/data-order-events`
- `n02_7994/acct-main` --exposed_to_internet--> `n24_7994/s3-status-page`
- `n04_7994/role-batch-service` --attached_policy--> `n23_7994/pol-batch-service`
- `n04_7994/role-batch-service` --can_read--> `n16_7994/sqs-order-events`
- `n00_7994/role-release-audit` --attached_policy--> `n10_7994/pol-release-audit-read`
- `n17_7994/role-partner-sync` --attached_policy--> `n18_7994/pol-partner-sync-read`
- `n21_7994/s3-ops-runbooks` --logs_to--> `n11_7994/trail-ops-runbooks`
- `n21_7994/s3-ops-runbooks` --stores_sensitive_data--> `n05_7994/data-ops-runbooks`
- `n12_7994/s3-audit-evidence` --logs_to--> `n22_7994/trail-audit-evidence`
- `n12_7994/s3-audit-evidence` --stores_sensitive_data--> `n09_7994/data-audit-evidence`
- `n01_7994/s3-app-config` --logs_to--> `n19_7994/trail-app-config`
- `n01_7994/s3-app-config` --stores_sensitive_data--> `n06_7994/data-app-config`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub