amazon-sqs - 如何允许 AWS SQS 仅由一个 lambda 读取？

Question

我已尝试应用以下 SQS 政策，但似乎不起作用：

{
  "Version": "2012-10-17",
  "Id": "SqsEdsPerms",
  "Statement": [
    {
      "Sid": "20180503",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::6000000000:root"
      },
      "Action": [
        "SQS:SendMessage",
        "SQS:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:6000000000:scs-dev-use1-myQueue",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": [
            "arn:aws:lambda:us-east-1:6000000000:function:scs-dev-use1-myLambda"
          ]
        }
      }
    }
  ]
}

我能够编写另一个 lambda (myLambda2) 并仍然从 SQS (myQueue) 中读取消息。

标签： amazon-sqs

Answer 1

“主体”是被授予权限的资源，因此您的 lambda 的 ARN 应该去那里。

{
  "Version": "2012-10-17",
  "Id": "SqsEdsPerms",
  "Statement": [
    {
      "Sid": "20180503",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:lambda:us-east-1:6000000000:function:scs-dev-use1-myLambda"
      },
      "Action": [
        "SQS:SendMessage",
        "SQS:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:6000000000:scs-dev-use1-myQueue"
    }
  ]
}