[Python / Lambda] boto3 sqs client raise botocore.exception.ClientError(Access Denied)

Question

[ENV]
Trigger Lambda -> ap-northeast-2
SQS queue -> ap-northeast-1
Crawler EC2 -> ap-northeast-1

[Pipeline]
Trigger Lambda -> send_message -> SQS queue -> Crawler EC2

[Permission]
Trigger Lambda -> queue.grant_send_messages(trigger_lambda)
Crawler EC2 -> queue.grant_consume_messages(crawler_cluster_worker)

[Owner]
ALL -> root account

[Python Code in Trigger Lambda]
sqs_client.send_message(
                    QueueUrl=CRAWLER_SQS_MESSAGE_QUEUE_URL,
                    MessageBody=json.dumps(sqs_message)
                )

[Trigger Lambda's Error Detail]
[ERROR] ClientError: An error occurred (AccessDenied) when calling the SendMessage operation: Access to the resource https://sqs.ap-northeast-1.amazonaws.com/ is denied.
Traceback (most recent call last):
  File "/var/task/main.py", line 136, in lambda_handler
    raise e
  File "/var/task/main.py", line 116, in lambda_handler
    sqs_client.send_message(
  File "/var/task/botocore/client.py", line 530, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/task/botocore/client.py", line 960, in _make_api_call
    raise error_class(parsed_response, operation_name)

[Question]
The trigger lambda failed an sending sqs message always succeeded. There are no issues with permissions and regions. It is judged to be a temporary error. Can you tell me what could be the reason for the temporary error?

Accepted Answer

If you're seeing this error all the time then the Lambda function doesn't have permission to send to that SQS queue. Check the IAM permissions and the role assigned to the Lambda function.

If you're seeing this error intermittently then there is something wrong - please contact our support team so that they can investigate. Here on re:Post we don't have access to your details, your account and the services that you're using. This is a forum for general advice; the support team are there to help with troubleshooting these types of issues.

[Python / Lambda] boto3 sqs client raise botocore.exception.ClientError(Access Denied)

Relevant content