---
title: "IAM recipes"
description: "Policies for producers, consumers, push subscription owners and operators, and for keeping queues from being purged or deleted."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM recipes

Message actions are checked against the **queue**, so a policy can let a workload send to or
receive from one queue only. A queue's resource name is on its page in the console, and in its
`resourceName`:

```
ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe
```

| Resource pattern | Matches |
| --- | --- |
| `…:prj_<project>:que_<slug>` | One queue |
| `…:prj_<project>:que_*` | Every queue in the project |
| `…:prj_<project>:qsb_*` | Every subscription in the project |
| `ezgh:*:org_<org>:prj_<project>` | The project, for `queues.queues.list`, `queues.queues.create`, `queues.subscriptions.list` and `queues.limits.get` |

Resource names hold the slug, not the queue's name, so a pattern can't select queues by name.
The full action list is in [Permissions](/queues#permissions).

Workloads use an [API key](/iam/api-keys) for a [bot](/iam/bots) with a policy like these.
Acknowledging messages and changing their visibility need no permission: a consumer that can
receive can acknowledge what it received.

## A producer for one queue

```json
{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.messages.send"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe"]
    }
  ]
}
```

## A consumer for one queue

`queues.queues.get` is optional: it lets the consumer read the queue's settings and counts.

```json
{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.messages.receive", "queues.queues.get"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe"]
    }
  ]
}
```

Receiving consumes messages: it's a write action, not in `QueuesReadOnlyAccess` or
`ReadOnlyAccess`.

## A team that manages a queue's push subscription

Creating a subscription is checked against its queue; changing, pausing and deleting it against
the subscription. Resuming is checked as `queues.subscriptions.pause`, and rotating the secret as
`queues.subscriptions.update`.

```json
{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.subscriptions.create", "queues.queues.get"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_4k2m9x0a7qpe"]
    },
    {
      "effect": "allow",
      "actions": ["queues.subscriptions.list"],
      "resources": ["ezgh:*:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2"]
    },
    {
      "effect": "allow",
      "actions": ["queues.subscriptions.*"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:qsb_*"]
    }
  ]
}
```

## Operators who redrive dead-letter queues

Attach `QueuesReadOnlyAccess`, so they can see queues and peek at messages without consuming
them, and a policy that lets them start redrives of one dead-letter queue:

```json
{
  "statements": [
    {
      "effect": "allow",
      "actions": ["queues.redrives.start"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_8k2m9x0q4r1s"]
    }
  ]
}
```

A redrive back to the messages' source queues is checked against the DLQ only. A redrive to a
named `destinationQueueId` is also checked against the destination.

## Everything but purging and deleting

Attach `QueuesFullAccess`, and deny the actions that delete messages in bulk:

```json
{
  "statements": [
    {
      "effect": "deny",
      "actions": ["queues.queues.purge", "queues.queues.delete"],
      "resources": ["ezgh:us-west-1:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:que_*"]
    }
  ]
}
```

Source: https://docs.ezghcloud.com/queues/iam/index.mdx