How configure an already ReadOnly user to allow just ReadOnly access in Amazon MQ WebConsole.

Hlo,

1. Configure Broker Authorization Firstly, ensure that the broker's authorization policy is correctly set up to grant read-only access. Your current setup is partially correct but needs to be expanded to cover the web console permissions.

Edit the activemq.xml configuration file to define the appropriate authorizationEntry tags. You need to specify the admin, read, and write permissions for each destination:

<authorizationPolicy>
    <map>
        <authorizationMap>
            <authorizationEntries>
                <authorizationEntry queue=">" read="customerservice" write="admin" admin="admin"/>
                <authorizationEntry topic=">" read="customerservice" write="admin" admin="admin"/>
                <!-- Add other necessary authorization entries -->
            </authorizationEntries>
        </authorizationMap>
    </map>
</authorizationPolicy>

In this example, the customerservice group has read-only access to all queues and topics (queue=">" and topic=">"). Adjust the destinations as per your requirements

2. Configure Web Console Security ActiveMQ’s web console uses JAAS (Java Authentication and Authorization Service) for authentication and authorization. You need to ensure that the roles and permissions for the web console are correctly defined.

JAAS Configuration Edit the login.config file to define roles and link them to your LDAP or the activemq.xml file for role management. For example:

activemq-domain {
    org.apache.activemq.jaas.PropertiesLoginModule required
        org.apache.activemq.jaas.properties.user="users.properties"
        org.apache.activemq.jaas.properties.group="groups.properties";
};

Web Console Role Configuration Edit the jetty-realm.properties file to set up the users and their roles. For example:

# users.properties
readonlyuser: readonlypassword, customerservice

# groups.properties
customerservice: readonlyuser

Web Console Context Configuration In the web.xml file located in the webapps/admin/WEB-INF directory of ActiveMQ, define the security constraints to restrict actions based on roles:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>ActiveMQ Console</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
        <role-name>customerservice</role-name>
    </auth-constraint>
</security-constraint>

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>ActiveMQRealm</realm-name>
</login-config>

<security-role>
    <role-name>admin</role-name>
</security-role>
<security-role>
    <role-name>customerservice</role-name>
</security-role>

3. Adjust Console Permissions To enforce read-only access in the web console, you may need to modify the jetty.xml file to fine-tune permissions, or use a custom plugin if necessary. However, typically, setting the correct roles and permissions as shown above should suffice.

4. Restart the Broker After making these changes, restart your ActiveMQ broker to apply the new configurations.

sudo service activemq restart

5. Verify the Configuration

Log in to the web console with the readonlyuser credentials and verify that they can only view the queues and topics but cannot delete or create them.

Hi,

The "activemq-webconsole" group in Amazon Active MQ has admin permissions on all queues and topics.

While it is possible to restrict access of web console users in the standalone ActiveMQ configuration via separate configuration files (conf/jetty-realm.properties. etc), this configuration change is not possible in the AmazonMQ service as of now. There is an existing feature request to support this feature, however there is no ETA or workaround.

I hope this addresses your concerns appropriately.