CODEWITHSUNDEEP
amazon-web-servicesamazon-sqsaws-cloudformation
user1573133
user1573133

Reputation: 964

aws cloudformation 2 sqspolicy for a single queue

I use cloudformation templates to create a sqs queue and apply two policies based on the user parameters. I created 2 sqs QueuePolicy resources and which refer to the queue. However when I try to apply two policies to a queue using Cloudformation templates, only the second one comes into effect. The cloudformation stack says two sqs policy resources have been created. However the admin console for sqs shows only the second one. The aws documentation for SQS says multiple policies could be applied to a single queue; however the cloudformation QueuePolicy does not have explicit mention on whether this is allowed or not. I tried swapping the policies and the second comes into effect all the time. My policy snippet has been attached.

"QueuePolicy1": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Id": "QueuePolicy1", "Statement": [ { "Sid": "QueuePolicy1-ReceiveMesasges", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:ChangeMessageVisibility" ], "Resource": "*", "Condition": { "ArnEquals": { "aws:SourceArn": { "Ref": "QOwnerArnParam" } } } }
] }, "Queues": [ { "Ref": "Queue1" } ] }, "Metadata": { "AWS::CloudFormation::Designer": { "id": "124145a7-3ad1-48e4-9478-04a930498db5" } }, "Condition": "Condition1" }, "QueuePolicy2": { "Type": "AWS::SQS::QueuePolicy", "Properties": { "PolicyDocument": { "Id": "QueuePolicy2", "Statement": [ { "Sid": "QueuePolicy2-SendMessage-To-Queue-From-SNS-Topic", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "sqs:SendMessage" ], "Resource": "*", "Condition": { "ArnEquals": { "aws:SourceArn": { "Ref": "TopicArnParam" } } } }
] }, "Queues": [ { "Ref": "Queue1" } ] }, "Metadata": { "AWS::CloudFormation::Designer": { "id": "124145a7-3ad1-48e4-9478-04a930498db5" } }, "Condition": "Condition2" },

Upvotes: 1

Views: 2483

Answers (3)

Himanshu Shekhar
Himanshu Shekhar

Reputation: 1

I have worked quite a lot of on sqs::queuepolicy and I can share that at one time a sqs queue can only have one policy attached but one queuepolicy can be attached to multiple queues.

Once you try to attach a new queue policy to the queue the old one will get overwritten. And in case you cloudformation template contains multiple policies since the CFN process are async whichever policy gets executed last will overwrite the earlier previous policy.

Upvotes: 0

gsaslis
gsaslis

Reputation: 3166

In my experience so far I've found that the AWS docs are very precise (sometimes almost too precise) and I think this is one of those cases.

The AWS CF docs for QueuePolicy say The AWS::SQS::QueuePolicy type applies a policy to SQS queues.

I know that when you first read this it might seem like your standard self-explanatory, didnt-know-what-else-to-write doc comment, but I think this is written very literally to imply / explain that the policy is simply set - i.e. it's not added to a list of policies.

I know this is probably not ideal for what you wanted to achieve, but I think your solution for the time being would be to merge the 2 policies.

Upvotes: 1

Paul Siersma
Paul Siersma

Reputation: 2206

There's not really a question here, but I'll add that you can add multiple statements to a single policy. I think a Queue has only a single policy containing multiple statements.

Upvotes: 1

Related Questions