How to restrict an SQS queue to accept SendMessage only from IAM roles with specific ARN prefixes?

Hello,

You can enforce this with an SQS resource-based policy. Allow sqs:SendMessage only for IAM roles whose ARN matches the required prefixes using Condition with ArnLike, and add an explicit Deny for all other roles in the account using Condition with ArnNotLike. Since explicit denies override any IAM allows, this guarantees that only roles whose ARN starts with the specified prefixes (usmg-dev-*, usmg-int-*, usmg-prd-*) can send messages, and every other role in the account will be blocked even if they have a permissive IAM policy.

Condition operators doc

Hope this helps :)

Hello You should apply a resource policy to your SQS queue that restrict access only to users with the specific prefix. Other users will get the implicit deny from the policy.

You cannot directly apply wildcards to principal statements, you must use the condition statement, as shown below:

{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": "", "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs::123456789012:MyCompanyQueue, "Condition": { "ArnLike": { "aws:PrincipalArn": "arn:aws:iam::<account-id>:role/usmg-int-*" } } }] }

Hope this helps

Serge

You can achieve this with a queue resource policy using Condition + ArnLike on aws:PrincipalArn. Example:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "", "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:us-east-1:<account-id>:<queue-name>", "Condition": { "ArnLike": { "aws:PrincipalArn": [ "arn:aws:iam::<account-id>:role/usmg-dev-", "arn:aws:iam::<account-id>:role/usmg-int-", "arn:aws:iam::<account-id>:role/usmg-prd-" ] } } } ] }

This allows only roles matching those prefixes to send messages — everyone else will be denied even if they have IAM policies granting sqs:SendMessage.