AWS – "SQS Cross Account Access" Fails on Multi-Valued Conditions

Given a queue policy like this:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": "sqs:SendMessage",
"Resource": "arn:{PARTITION}:sqs:{REGION}:{ACCOUNT}:{QUEUENAME}",
"Condition": {
"ArnEquals": {
"aws:SourceArn": [
"arn:{PARTITION}:events:{REGION}:{ACCOUNT}:rule/{BUS}/{RULENAME1}",
"arn:{PARTITION}:events:{REGION}:{ACCOUNT}:rule/{BUS}/{RULENAME2}"
]
}
}
}
]
}
```

…where `PARTITION`, `REGION`, and `ACCOUNT` are the same all-around, Aqua reports "The SQS queue policy allows cross-account access to the action(s): sqs:SendMessage". For otherwise-identical policies which have single-valued conditions, nothing is reported. Reporting nothing appears to be correct.

Start by locating the AWS SQS queue-policy cross-account check and reproduce the multi-valued ArnEquals policy shown here. Compare its result with the otherwise-identical single-valued condition case. Done means a same-account policy with multiple source ARNs is not reported as cross-account, while genuine cross-account access remains reported.

Written by the indexing model from the issue text.