How to add more than one S3 Bucket ARN to an SQS Queue Access Policy

Question

Hello:
I'm trying to add another S3 bucket to an existing SQS Queue. Try as I might, I can't find a way to add it to the existing policy. Example:

{
      "Sid": "example-statement-ID",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "SQS:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:0645xxxxxxxx:HammerSQS1",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "064xxxxxxxx"
        },
        "ArnLike": ": {[
          "aws:SourceArn": "arn:aws:s3:*:*:contentdisarming-bucket-one"
**          "aws:SourceArn": "arn:aws:s3:*:*:contentdisarming-bucket-two"]
**        {
        }
      }
    }
  ]
}

When I try to add the 2nd bucket (contentdisarming-bucket-two) I get an error: "Invalid JSON" What am I doing wrong here? It's possible to add more than one S3 SourceArn to an SQS queue, correct?

Thanks in advance..

Answer

It seems some of the policy you posted is formatted outside of the code block so it looks like there's a lot wrong with it (e.g. "**", "{ }", lack of comma between the bucket ARNs).  Can you try re-posting your complete policy with the 2nd bucket included, and no special formatting etc?

Answer

Hi Folks:
Figured it out. The brackets were in the wrong places, here is the JSON for the SQS Access Policy that works. What I wanted to achieve was to get two S3 buckets connected to the same SQS Queue:

```{
	"Version": "2012-10-17",
	"Id": "example-ID",
	"Statement": [{
		"Sid": "example-statement-ID",
		"Effect": "Allow",
		"Principal": {
			"Service": "s3.amazonaws.com"
		},
		"Action": "SQS:SendMessage",
		"Resource": "arn:aws:sqs:us-east-1:0645********:HammerSQS1",
		"Condition": {
			"StringEquals": {
				"aws:SourceAccount": "0645********"
			},
			"ArnLike": {
				"aws:SourceArn": [
					"arn:aws:s3:*:*:contentdisarming-bucket-one",
					"arn:aws:s3:*:*:contentdisarming-bucket-two"
				]
			}
		}
	}]
}

```
Hope this saves someone else some time & frustration :)

How to add more than one S3 Bucket ARN to an SQS Queue Access Policy

Relevant content