Using aws cli to add send message permission for SQS

Question

I'm trying to set up an existing SQS Queue as a subscriber to an SNS topic. In the AWS console in the permissions tab, I can set the policy document to

{
  "Version": "2012-10-17",
  "Id": "arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue/SQSDefaultPolicy",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:sns:us-east-1:7670234568007:new_posts"
        }
      }
    }
  ]
}

How can I do this using the aws-cli

Marcin Marcin · Accepted Answer · 2020-06-09T10:27:19

This is an practical example of how to do it using set-queue-attributes:

cat >/tmp/sqs_polcy << EOL
{
    "Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue\/SQSDefaultPolicy\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"sqs:SendMessage\",\"Resource\":\"arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue\",\"Condition\":{\"ArnEquals\":{\"aws:SourceArn\":\"arn:aws:sns:us-east-1:7670234568007:new_posts\"}}}]}"
}
EOL

aws sqs set-queue-attributes \
    --queue-url https://<your-queue-url> \
    --attributes file:///tmp/sqs_polcy

Above I create /tmp/sqs_polcy file with the policy, which is required for the set-queue-attributes command.

Your policy must be stringified from json, before you can use in the CLI command.

Using aws cli to add send message permission for SQS

2 Answers