Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot post to SQS queue that is not owned by Caesar #1238

Open
hughdickinson opened this issue Dec 14, 2020 · 1 comment
Open

Cannot post to SQS queue that is not owned by Caesar #1238

hughdickinson opened this issue Dec 14, 2020 · 1 comment

Comments

@hughdickinson
Copy link
Collaborator

Caesar seems unable to send messages to SQS queues created using another AWS count, even if access to that queue by Caesar is granted using an access policy modelled on the one used for queues that are owned by Caesar. e.g. (with potentially sensitive strings redacted)

{
  "Version": "2012-10-17",
  "Id": "arn:aws:sqs:us-east-1:<non_caesar_owner_arn>:<queue_name>/SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "33B59DA5-0F94-443B-8904-E652B8FFEA73",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<non_caesar_owner_arn>:root"
      },
      "Action": "SQS:*",
      "Resource": "arn:aws:sqs:us-east-1:<non_caesar_owner_arn>:<queue_name>"
    },
    {
      "Sid": "8C9F2711-6FA7-4C7B-98B2-A86395C80417",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<caesar_arn>:user/caesar"
      },
      "Action": "SQS:*",
      "Resource": "arn:aws:sqs:us-east-1:<non_caesar_owner_arn>:<queue_name>"
    }
  ]
}

Note that the Sids are auto-generated UUIDs and the Id format is modelled on the policy used for queues that are owned by Caesar. In fact it can be any string and is only used for naming purposes.

@lcjohnso
Copy link
Member

@zwolf -- Do you have an ideas why POSTs to external SQS queues would not be successful?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants