How do I grant access to an Amazon SQS queue?

Resolution

To access an Amazon SQS queue, you must add permissions to the SQS access policy, the IAM policy, or both. The specific permissions requirements depend on whether the SQS queue and IAM role are from the same AWS account.

Same account

A statement’s required in either the SQS access policy or the IAM policy to allow access.

Note: If either the SQS access policy or IAM policy explicitly allows access, but the other policy explicitly denies access, then access to the queue’s denied.

Different account

A statement’s required in both the SQS access policy and the IAM policy to allow access.

Example policy statements

The following example policies show the permissions that you must set on the IAM policy and SQS queue access policy. These policies allow cross-account access for an SQS queue.

Example IAM policy statement for username1

The following policy grants permissions for username1 to send messages to the resource arn:aws:sqs:us-east-1:123456789012:queue_1:

{
   "Version": "2012-10-17",
   "Statement": [{
      "Effect": "Allow",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:queue_1"
   }]
}

Example SQS resource policy statement for queue_1

The following policy allows username1 to send messages to the SQS queue:

{   "Version": "2012-10-17",
   "Id": "Queue1_Policy",
   "Statement": [{
      "Sid":"Queue1_AllActions",
      "Effect": "Allow",
      "Principal": {
         "AWS": [
            "arn:aws:iam::111122223333:user/username1"
         ]
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:queue_1"
   }]
}

For more information, see IAM policy types: How and when to use them.