AWS security group rules deployment (lambda->SQS)

Question

On AWS we've implemented functionality that AWS lambda pushes message to AWS queue;

However during this implementation I had to manuall grant permissions to AWS lambda to add message to particular queue. And this apporach with manual clicks not so good for prod deployment.

Any suggestions how to automate process of adding permissions between AWS services (mainly lambda and SQS) and cretate "good" deployment package for prod env ?

Luc Hendriks Luc Hendriks · Accepted Answer · 2016-02-29T14:04:40

Each Lambda function has an attached role, which you can specify permissions for in the IAM dashboard. If you give the Lambda functions' role the permission to push to an SQS queue, you're good to go. For example, attach this JSON as a custom role (see http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/SQSExamples.html):

{
  "Version": "2012-10-17",
  "Id": "Queue1_Policy_UUID",
  "Statement": 
    {
       "Sid":"Queue1_SendMessage",
       "Effect": "Allow",
       "Principal": {
            "AWS": "111122223333"
         },
        "Action": "sqs:SendMessage",
        "Resource": "arn:aws:sqs:us-east-1:444455556666:queue1"
     }
}

You can use asterisks to give permission to multiple queues, like:

"Resource": "arn:aws:sqs:us-east-1:444455556666:production-*"

To give sendMessage permission to all queues that start with production-.

AWS security group rules deployment (lambda->SQS)

1 Answers