I'm trying to set up an existing SQS Queue as a subscriber to an SNS topic. In the AWS console in the permissions tab, I can set the policy document to
{
"Version": "2012-10-17",
"Id": "arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue/SQSDefaultPolicy",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "sqs:SendMessage",
"Resource": "arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue",
"Condition": {
"ArnEquals": {
"aws:SourceArn": "arn:aws:sns:us-east-1:7670234568007:new_posts"
}
}
}
]
}
How can I do this using the aws-cli
These are generally managed via the CLI command of add-permission for SQS.
However as you're using your own custom policy the AWS documentation states the following
AddPermission generates a policy for you. You can use
SetQueueAttributesto upload your policy.
This would be accessible via the set-queue-attributes function.
Your policy will need to be be converted into a JSON file, against the key value of Policy.
As a word of caution by doing this it will replace the policy attached to your SQS queue, so make sure to validate it before hand.
This is an practical example of how to do it using set-queue-attributes:
cat >/tmp/sqs_polcy << EOL
{
"Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue\/SQSDefaultPolicy\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"sqs:SendMessage\",\"Resource\":\"arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue\",\"Condition\":{\"ArnEquals\":{\"aws:SourceArn\":\"arn:aws:sns:us-east-1:7670234568007:new_posts\"}}}]}"
}
EOL
aws sqs set-queue-attributes \
--queue-url https://<your-queue-url> \
--attributes file:///tmp/sqs_polcy
Above I create /tmp/sqs_polcy file with the policy, which is required for the set-queue-attributes command.
Your policy must be stringified from json, before you can use in the CLI command.