Question 71728 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

AWS IAM policy for Event-Bridge to SQS with deny – Amazon web services

I want to restrict my sqs to accept only from event-bridge rule, below IAM rule looks correct with deny in place, but sqs not receiving message with this, any input appreciated.

{   "Id": "Policy",   "Version": "2012-10-17",   "Statement": [
    {
      "Sid": "sid",
      "Action": [
        "sqs:SendMessage"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      },
      "Principal": "*"
    }   ] }

The one generated by Event-bridge to allow sqs access looks like this

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "AWSEvents_sri-test-sqs-rule_Id12",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      }
    }
  ]
}
Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    We just had to put some combination of principalTypes to achieve this, below one worked finally

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ownerstatement",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:xxxx:sri-test-queue-3"
    },
    {
      "Sid": "DenyAllExceptBus",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:xxxx:sri-test-queue-3",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": [
            "arn:aws:events:us-east-1:xxxx:rule/sri-test-bus/sri-test-sqs-rule"
          ]
        }
      }
    }
  ]
}

  2. 0

    Use the bottom policy. SQS policy denies by default, so you do not need to worry about other resources posting messages to SQS. The policy would allow only arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule to send the messages.

    The problem with the policy statement you wrote was that you did not have an "Allow" statement, so SQS is denying SendMessage actions from every source.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search