Back to Checks
iac

Ensure MQ Broker is not publicly exposed

AWS-0072
Service: mqSeverity: high
OfficialBuilt-inVerified

Public access of the MQ broker should be disabled and only allow routes to applications that require access.

Prowler logoProwlerprowler-provider-iac

Run this check with Prowler

Run in Prowler Cloud
Run
prowler iac --checks AWS-0072

Recommendation

Disable public access when not required

Check Code

# METADATA
# title: Ensure MQ Broker is not publicly exposed
# description: |
#   Public access of the MQ broker should be disabled and only allow routes to applications that require access.
# scope: package
# schemas:
#   - input: schema["cloud"]
# related_resources:
#   - https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/using-amazon-mq-securely.html#prefer-brokers-without-public-accessibility
# custom:
#   id: AWS-0072
#   long_id: aws-mq-no-public-access
#   aliases:
#     - AVD-AWS-0072
#     - no-public-access
#     - aws-mq-no-public-access
#   provider: aws
#   service: mq
#   severity: HIGH
#   recommended_action: Disable public access when not required
#   input:
#     selector:
#       - type: cloud
#         subtypes:
#           - service: mq
#             provider: aws
#   examples: checks/cloud/aws/mq/no_public_access.yaml
package builtin.aws.mq.aws0072

import rego.v1

deny contains res if {
	some broker in input.aws.mq.brokers
	broker.publicaccess.value == true

	res := result.new("Broker has public access enabled.", broker.publicaccess)
}

References