SQS queue access policies should not allow public access

How to fix it

Have the named queue's access policy name the principals allowed to use it, with no statement granting every principal, and none allowing everyone EXCEPT a named list. The write replaces the policy whole rather than merging, so start from the current document and keep the statement that lets your own account manage the queue. Whatever reached the queue through the open statement stops the moment you save, so a message from an event notification or a topic subscription is then refused rather than queued. A condition clears the finding only if it bounds the grant to a principal you control.

In the console

Simple Queue Service → Queues → the queue → Access policy

With the AWS CLI

aws sqs set-queue-attributes --queue-url <queue-url> --attributes file://queue-attributes.json --region <region>

With Terraform

resource "aws_sqs_queue_policy" "this" {
  queue_url = var.queue_url
  policy    = data.aws_iam_policy_document.no_public_access.json
}