‫Now let's talk about
‫SQS Queue Access Policies.
‫And there are two good use cases
‫for SQS Queue Access Policies.
‫They're similar to S3 Bucket policies
‫in terms that they are resource policies,
‫so JSON IAM policies
‫that you're going to add directly onto your SQS Queue.
‫So the first use cases to allow cross account access.
‫Say you have a queue in an account
‫and another account needs to access that queue.
‫Maybe it has an EC2 Instance.
‫So for that EC2 Instance to be able
‫to pull message across accounts,
‫what you need to do is to create a Queue Access Policy
‫that looks like this,
‫and you attach it to the SQS Queue in the first account.
‫What this Q access policy will do
‫is that it will allow the principle of AWS to be
‫111122223333,
‫which represents the account on the right hand side
‫on the sqs ReceiveMessage on this resource right here.
‫And so this Queue Access Policy is really what
‫will allow your EC2 Instance
‫to pull from the SQS Queue in another account.
‫Another use case for SQS Queue Access Policy
‫is for example,
‫when you have an S3 Bucket,
‫and it will publish event notifications to an SQS Queue.
‫So for example, you upload an object into an S3 Bucket,
‫and what you want is to get automatically
‫a message sent to the SQS Queue.
‫As you can see the SQS Queue,
‫wIll need to give permission to the S3 Bucket
‫to write a message to it.
‫And therefore we need to create our own
‫SQS Queue Access Policy that looks like this.
‫And if you look at the details for example,
‫the action is sqs:SendMessage,
‫the principal, AWS starts from any accounts
‫as long as the condition is that the sourceArn of the bucket
‫represents the S3 Bucket named bucket1,
‫and that the source accounts needs to be
‫the account owner of the S3 buckets.
‫So once you have this,
‫then the S3 bucket is allowed to write to an SQS Queue.
‫That's something important
‫because the exam will test you on, for example,
‫what is needed to write to SQS Queue
‫for cross account access
‫or for are publishing S3 event notifications.
‫So there you have it.
‫So let's create a queue
‫and set up an SQS Queue Access Policy.
‫So I'll call this one events from S3,
‫because we're going to set up an S3 event notification
‫to go into this SQS Queue.
‫I will keep everything else as the default.
‫Oh, and as we can see,
‫the SQS Access Policy is here.
‫And so here we can define what kind of services
‫can send data into our SQS Queue.
‫So if we choose the basic method,
‫then we can select only the queue owner
‫to send data into our SQS Queue
‫which would represent this,
‫or we can select only the specified accounts,
‫IAM users and roles specified right here.
‫So this is one to get cross or accounts access
‫for who can send messages to the queue.
‫We have the same dialogue for
‫who can receive messages from the queue.
‫Okay.
‫Message is not going to help us for Amazon is free
‫or we can do advanced and write
‫our own SQS Queue Access Policy for this.
‫So in the meantime,
‫I'm just gonna choose Basic.
‫Show you that things don't work in the beginning,
‫and then we're going to modify it
‫and then see that things will work afterwards.
‫So we're going to create this queue right here
‫and I'm going to go now into Amazon S3, okay?
‫And I'm going to create an S3 Bucket.
‫And from the S3 Bucket,
‫set up event notification to send data into our SQS Queue.
‫So let's create a bucket across demo-sqs-queue-access-policy
‫and I will click on create bucket.
‫Okay.
‫So here it is.
‫Then I'm going to go into Properties,
‫scroll down,
‫find our event notifications.
‫And I'm going to create an event notification.
‫I'll call it it, NewObjects
‫and for all prefix or suffix
‫and for event types,
‫we're gonna choose All objects create events.
‫So perfect.
‫Scroll down,
‫and the destination is going to be an SQS Queue.
‫We need to choose from the SQS Queue,
‫so we find EventFrom S3,
‫click on Save changes.
‫And as we can see, we get an error
‫because right now it is unable to validate
‫the following destination configurations.
‫So what we need to do is to go into this access policy
‫and we need to modify it to allow our S3 Bucket
‫to write into our SQS Queue.
‫So for this,
‫we can go directly into the documentation
‫and see if we can find this policy for us.
‫So we'll just do a simple Google.
‫So S3 events into SQS access policy.
‫And they should give us access to what we need.
‫So, okay, perfect.
‫We have event notifications.
‫And then I'm going to go into Amazon SQS.
‫So granting permissions.
‫Here we go.
‫Configuring SQS and SNS.
‫And then we're going to add this.
‫And here is the policy document that we need to set up
‫for our SQS Queue.
‫So I'm going to copy it,
‫edit this,
‫and I'm going to paste it.
‫And so we need to change to have the QRN.
‫So let me just do a small, dirty edit right here.
‫But the resource QRN have to copy from here
‫and paste it there.
‫Okay.
‫And then we to say that the condition is that ArnLike,
‫the source bucket has to be named just
‫like our source bucket,
‫so let's find the name of our source bucket right here,
‫that we will copy into this policy.
‫And the source account owner is the accounts
‫we have right now.
‫So I'm going to go right here,
‫find my account ID which is right here,
‫copy it and paste it.
‫So this policy, and I need to delete the old one.
‫So this policy allows our S3 Bucket to send a message
‫into our SQS Queue.
‫Fairly good.
‫We'll save this.
‫And it is not a valid JSON
‫because I'm missing a comma.
‫Click on save.
‫And here we go.
‫So now with this new policy,
‫let's see if we can save our event notification.
‫And yes we can.
‫So this was completed successfully.
‫And actually if you go into Amazon SQS
‫and you're going to send and receive messages,
‫there's one message that is available,
‫we can pull for it,
‫look at it and see that the test event
‫was sent by Amazon is free into our SQS Queue.
‫So that's it,
‫really for this hands-on
‫we could, if we wanted to upload a message,
‫upload a file into Amazon is free and see it into SQS.
‫But what I want to show you here
‫is that the fact that by modifying an access policy,
‫we did provide access from our S3 Bucket
‫into our SQS Queue,
‫and this is the effect we wanted.
‫So that's it for this lecture.
‫I hope you liked it.
‫And I will see you in the next lecture.