'alert on cross account access'

def check_sqsqueue_crossaccount(self, sqsitem):

    policy = sqsitem.config
    for statement in policy.get('Statement', []):
        account_numbers = []
        princ = statement.get('Principal', None)
        if (not princ):
            tag = 'SQS    Policy    is    lacking    Principal    field'
            notes = json.dumps(statement)
            self.add_issue(5, tag, sqsitem, notes=notes)
            continue
        if isinstance(princ, dict):
            princ_val = (princ.get('AWS') or princ.get('Service'))
        else:
            princ_val = princ
        if (princ_val == '*'):
            condition = statement.get('Condition', {})
            arns = ARN.extract_arns_from_statement_condition(condition)
            if (not arns):
                tag = 'SQS    Queue    open    to    everyone'
                notes = "An    SQS    policy    where    {    'Principal':    {    'AWS':    '*'    }    }    must    also    have"
                notes += "    a    {'Condition':    {'ArnEquals':    {    'AWS:SourceArn':    '<ARN>'    }    }    }"
                notes += '    or    it    is    open    to    the    world.    In    this    case,    anyone    is    allowed    to    perform    '
                notes += '    this    action(s):    {}'.format(statement.get('Action'))
                self.add_issue(10, tag, sqsitem, notes=notes)
            for arn in arns:
                self._parse_arn(arn, account_numbers, sqsitem)
        elif isinstance(princ_val, list):
            for entry in princ_val:
                arn = ARN(entry)
                if arn.error:
                    self.add_issue(3, 'Auditor    could    not    parse    ARN', sqsitem, notes=entry)
                    continue
                if (not arn.service):
                    account_numbers.append(arn.account_number)
        else:
            arn = ARN(princ_val)
            if arn.error:
                self.add_issue(3, 'Auditor    could    not    parse    ARN', sqsitem, notes=princ_val)
            elif (not arn.service):
                account_numbers.append(arn.account_number)
        for account_number in account_numbers:
            self._check_cross_account(account_number, sqsitem, 'policy')
