配置IAM Deny策略限制SQS仅接收EventBridge消息失败，求助排查

你希望限制SQS仅接收来自特定EventBridge规则的消息，配置Deny策略后无法接收消息，核心问题大概率出在权限策略的覆盖或合并逻辑上，以下是具体分析和修复方案：

你当前的两个策略 #

自定义Deny策略 #

{
  "Id": "Policy",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "sid",
      "Action": [
        "sqs:SendMessage"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      },
      "Principal": "*"
    }
  ]
}

EventBridge自动生成的Allow策略 #

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "AWSEvents_sri-test-sqs-rule_Id12",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      }
    }
  ]
}

核心问题 #

如果你的SQS策略是单独设置Deny策略时覆盖了EventBridge生成的Allow策略，那么即使Deny策略不拒绝EventBridge的请求，也没有对应的Allow权限允许它发送消息（SQS默认拒绝所有外部访问），最终导致消息无法投递。

修复方案 #

将两个策略的Statement合并为一个完整的SQS访问策略，同时统一使用较新的2012-10-17版本：

{
  "Id": "RestrictSQStoSpecificEventBridgeRule",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEventBridgeRuleSendMessage",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      }
    },
    {
      "Sid": "DenyNonMatchingSendMessage",
      "Effect": "Deny",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      },
      "Principal": "*"
    }
  ]
}

额外检查点 #

1. 验证EventBridge规则配置：确认规则的目标确实指向该SQS，且事件模式能正确触发规则（可通过EventBridge的测试功能验证）
2. ARN准确性：检查策略中的SQS ARN、EventBridge规则ARN是否完全匹配（包括区域、账号ID、总线名称、规则名称）
3. 权限评估逻辑：IAM权限遵循「Deny优先」原则，合并后的策略会先判断是否匹配Deny条件：
   • 若请求来自指定EventBridge规则，Deny条件不触发，Allow策略生效，允许发送
   • 若请求来自其他主体或规则，Deny条件触发，直接拒绝发送

内容的提问来源于stack exchange，提问作者Srini