AWS – "SQS Cross Account Access" Fails on Multi-Valued Conditions

[chrisoverzero]

Given a queue policy like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:{PARTITION}:sqs:{REGION}:{ACCOUNT}:{QUEUENAME}",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": [
            "arn:{PARTITION}:events:{REGION}:{ACCOUNT}:rule/{BUS}/{RULENAME1}",
            "arn:{PARTITION}:events:{REGION}:{ACCOUNT}:rule/{BUS}/{RULENAME2}"
          ]
        }
      }
    }
  ]
}

…where PARTITION, REGION, and ACCOUNT are the same all-around, Aqua reports "The SQS queue policy allows cross-account access to the action(s): sqs:SendMessage". For otherwise-identical policies which have single-valued conditions, nothing is reported. Reporting nothing appears to be correct.

[AkhtarAmir]

@chrisoverzero we added a fix related to similar issue. Are you still facing the same error?

[chrisoverzero]

@AkhtarAmir Yes, I am still facing it. If you mean #917, that’s about when the problem began, even.