Is it possible to limit sns:Subscribe in the SNS topic's access policy to a specific SQS queue ARN for cross-account subscriptions?

0

Hi,

I know its possible to limit sns:Subscribe to a specific IAM role for cross-account subscriptions to an SNS topic in the topic's access policy, but I'm wondering if its possible to do the same for an SQS queue that subscribes to the SNS topic because the SQS queue is not able to assume a role.

Below you can see our SNS topic's access policy that limits based on AWS account:

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "Allow-TitleStatusEvents-To-Subscribe",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::1111111111:root"
      },
      "Action": "sns:Subscribe",
      "Resource": "arn:aws:sns:us-west-2:nnnnn"
    },
  // ...
}

Any ideas?

Thanks!

preguntada hace un año441 visualizaciones
1 Respuesta
0

Hello.

An access policy is a policy for allowing access, so if you are going to set it, I think you need to use an SQS access policy instead of an SNS access policy.
I think the SQS access policy described in the following document is easy to understand.
The following SQS access policy is for SQS "arn:aws:sqs:us-east-2:444455556666:MyQueue" only from SNS topic "arn:aws:sns:us-east-2:444455556666:MyTopic" Access is allowed.
https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-use-cases.html#sns-publish-messages-to-sqs-queue

{
  "Statement": [{
    "Sid": "Allow-SNS-SendMessage",
    "Effect": "Allow",
    "Principal": {
      "Service": "sns.amazonaws.com"
    },
    "Action": ["sqs:SendMessage"],
    "Resource": "arn:aws:sqs:us-east-2:444455556666:MyQueue",
    "Condition": {
      "ArnEquals": {
        "aws:SourceArn": "arn:aws:sns:us-east-2:444455556666:MyTopic"
      }
    }
  }]
}
profile picture
EXPERTO
respondido hace un año

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas