AmazonMQ(ActiveMQ 5.17.1)权限配置问题：myUser无法写入Advisory主题

问题场景 #

通过Terraform配置AmazonMQ（ActiveMQ 5.17.1），初始未设置authorizationMap时用户myUser可正常连接客户端。配置自定义权限规则并将myUser加入admins组后，客户端及AWS日志报错无权限写入ActiveMQ.Advisory.Connection主题；添加Advisory主题的权限规则后问题依旧；开启控制台访问的其他用户可正常创建队列，但发送消息时也报错。每次修改配置后均强制重启Broker，问题未解决。

当前配置 #

AuthorizationMap配置 #

<authorizationPlugin>
    <map>
        <authorizationMap>
            <authorizationEntries>
                <authorizationEntry queue="SYS1.IN.>" read="system1"/>
                <authorizationEntry queue="SYS2.IN>" read="system2"/>
                <authorizationEntry queue="SYS2.OUT>" write="system2"/>
                <!-- few other queues / permissions -->
                <authorizationEntry admin="admins,activemq-webconsole" read="admins,users,activemq-webconsole" write="admins,activemq-webconsole" queue=">"/>
                <authorizationEntry admin="admins,activemq-webconsole" read="admins,users,activemq-webconsole" write="admins,activemq-webconsole" topic=">"/>
            </authorizationEntries>
        </authorizationMap>
    </map>
</authorizationPlugin>

Terraform用户配置 #

user {
    username = "myUser"
    password = "somethingSecret"
    groups = ["admins"]
}

报错信息 #

... User myUser doesn't have permission to write in topic `ActiveMQ.Advisory.Connection` ...

解决方案 #

1. 修正通配符语法错误 #

ActiveMQ使用.作为资源层级分隔符，>需搭配.实现子资源通配匹配。当前配置中部分队列规则的通配符语法错误，会导致权限规则解析异常：

• 将<authorizationEntry queue="SYS2.IN>" read="system2"/>改为<authorizationEntry queue="SYS2.IN.>" read="system2"/>
• 将<authorizationEntry queue="SYS2.OUT>" write="system2"/>改为<authorizationEntry queue="SYS2.OUT.>" write="system2"/>

2. 调整Advisory主题权限规则顺序 #

ActiveMQ权限规则按定义顺序优先匹配，将Advisory主题的权限规则移至最顶部，确保优先匹配：

<authorizationEntry topic="ActiveMQ.Advisory.>" admin="admins,activemq-webconsole" read="admins,users,activemq-webconsole" write="admins,users,activemq-webconsole"/>

3. 完整修正后的AuthorizationMap配置 #

<authorizationPlugin>
    <map>
        <authorizationMap>
            <authorizationEntries>
                <!-- 优先匹配Advisory主题权限 -->
                <authorizationEntry topic="ActiveMQ.Advisory.>" admin="admins,activemq-webconsole" read="admins,users,activemq-webconsole" write="admins,users,activemq-webconsole"/>
                <!-- 自定义队列权限 -->
                <authorizationEntry queue="SYS1.IN.>" read="system1"/>
                <authorizationEntry queue="SYS2.IN.>" read="system2"/>
                <authorizationEntry queue="SYS2.OUT.>" write="system2"/>
                <!-- 其他自定义权限规则 -->
                <!-- 默认全局权限 -->
                <authorizationEntry admin="admins,activemq-webconsole" read="admins,users,activemq-webconsole" write="admins,activemq-webconsole" queue=">"/>
                <authorizationEntry admin="admins,activemq-webconsole" read="admins,users,activemq-webconsole" write="admins,activemq-webconsole" topic=">"/>
            </authorizationEntries>
        </authorizationMap>
    </map>
</authorizationPlugin>

4. 验证配置生效 #

确认Terraform中aws_mq_broker资源已正确引用更新后的authorizationMap，执行terraform apply重新部署配置，之后强制重启Broker。

内容的提问来源于stack exchange，提问作者рüффп