IAM recipes

Message actions are checked against the queue, so a policy can let a workload send to or receive from one queue only. A queue’s resource name is on its page in the console, and in its resourceName:

ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe

Resource names hold the slug, not the queue’s name, so a pattern can’t select queues by name. The full action list is in Permissions.

Workloads use an API key for a bot with a policy like these. Acknowledging messages and changing their visibility need no permission: a consumer that can receive can acknowledge what it received.

A producer for one queue

{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.messages.send"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe"]
    }
  ]
}

A consumer for one queue

queues.queues.get is optional: it lets the consumer read the queue’s settings and counts.

{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.messages.receive", "queues.queues.get"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe"]
    }
  ]
}

Receiving consumes messages: it’s a write action, not in QueuesReadOnlyAccess or ReadOnlyAccess.

A team that manages a queue’s push subscription

Creating a subscription is checked against its queue; changing, pausing and deleting it against the subscription. Resuming is checked as queues.subscriptions.pause, and rotating the secret as queues.subscriptions.update.

{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.subscriptions.create", "queues.queues.get"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe"]
    },
    {
      "effect": "allow",
      "actions": ["queues.subscriptions.list"],
      "resources": ["ezgh:*:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2"]
    },
    {
      "effect": "allow",
      "actions": ["queues.subscriptions.*"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:qsb_*"]
    }
  ]
}

Operators who redrive dead-letter queues

Attach QueuesReadOnlyAccess, so they can see queues and peek at messages without consuming them, and a policy that lets them start redrives of one dead-letter queue:

{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.redrives.start"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_8k2m9x0q4r1s"]
    }
  ]
}

A redrive back to the messages’ source queues is checked against the DLQ only. A redrive to a named destinationQueueId is also checked against the destination.

Everything but purging and deleting

Attach QueuesFullAccess, and deny the actions that delete messages in bulk:

{
  "statements": [
    {
      "effect": "deny",
      "actions": ["queues.queues.purge", "queues.queues.delete"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_*"]
    }
  ]
}