AWS SQS访问策略基于aws:SourceArn限制消息发送失效问题

你的SQS队列策略仅包含Deny规则，但缺少关键的Allow授权，导致指定Lambda依然无法发送消息，原因如下：

AWS权限模型遵循默认拒绝原则——任何未被显式允许的操作都会被拒绝。你当前的策略只拦截了非指定Lambda的SendMessage请求，但没有给指定Lambda授予发送消息的权限，所以即使它不会触发Deny规则，依然会因默认拒绝返回AccessDenied。

修正后的队列策略 #

添加一条Allow语句，明确授权指定Lambda执行sqs:SendMessage操作，同时保留原有的Deny规则拦截其他请求：

{
  "Version": "2012-10-17",
  "Id": "Policy1666948352567",
  "Statement": [
    {
      "Sid": "AllowSourceLambdaSendMessage",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:lambda:ap-southeast-2:444455556666:function:source-lambda"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:ap-southeast-2:444455556666:target-sqs"
    },
    {
      "Sid": "DenyAllOtherSendMessage",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:ap-southeast-2:444455556666:target-sqs",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:lambda:ap-southeast-2:444455556666:function:source-lambda"
        }
      }
    }
  ]
}

额外注意事项 #

除了队列的访问策略，还需要确保source-lambda的执行角色配置了sqs:SendMessage权限，允许其访问目标SQS队列。

内容的提问来源于stack exchange，提问作者Madhava Reddy