AWS EKS上SpringBoot应用调用SQS列表报403 Forbidden问题咨询

将SpringBoot应用部署在AWS EKS上，调用接口获取AWS SQS队列列表时触发403 Forbidden错误。目前仅需查看队列列表，不需要推送消息，请问是否需要在AWS SQS访问策略中添加特定配置来授予应用对应权限？

相关配置 #

pom.xml #

...
<dependency>
    <groupId>com.amazonaws</groupId>
    <artifactId>aws-java-sdk-sqs</artifactId>
</dependency>

AwsSqsController.java #

...
public ResponseEntity<ListQueuesResult> readQueueList() {
    AmazonSQS sqs = AmazonSQSClientBuilder.defaultClient();
    ListQueuesResult listOfQueues = sqs.listQueues();
    log.info("List of Queues: {}", listOfQueues);
    return ResponseEntity.ok(listOfQueues);
}

AWS SQS访问策略 #

{
  "Version": "2012-10-17",
  "Id": "HCDQueuePolicy",
  "Statement": [
    {
      "Sid": "AlwaysEncrypted",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "DenyAppOperatorEngineer",
      "Effect": "Deny",
      "Principal": {
        "AWS": "arn:aws:iam::X:role/role-name"
      },
      "Action": "sqs:SetQueueAttributes",
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name"
    },
    {
      "Sid": "AlwaysSameOrg",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:*",
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name",
      "Condition": {
        "Bool": {
          "aws:PrincipalIsAWSService": "false"
        },
        "StringNotEquals": {
          "aws:PrincipalOrgID": "00000000000"
        }
      }
    },
    {
      "Sid": "QueueProducerAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::X:role/role-name"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name",
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-X00000"
        }
      }
    },
    { 
      "Sid": "QueueConsumerAccessViaVpcEndpoint",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::X:role/role-name"
      },
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:GetQueueAttributes",
        "sqs:DeleteMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name",
      "Condition": {
        "StringEquals": {
          "aws:sourceVpce": "vpce-X00000"
        }
      }
    },
    {
      "Sid": "QueueConsumerAccessNotViaVpcEndpoint",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::X:role/role-name"
      },
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:GetQueueAttributes",
        "sqs:DeleteMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name"
    },
    {
      "Sid": "QueueAdminAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::X:role/role-name"
      },
      "Action": "sqs:PurgeQueue",
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name"
    },
    {
      "Sid": "Allow S3 notifications",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:X:queue-name",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "X"
        }
      }
    }
  ]
}

不需要修改AWS SQS的队列访问策略，核心原因和解决方案如下：

• sqs:ListQueues是账户级操作：该API用于查询当前AWS账户下的所有SQS队列，属于IAM权限管控范畴，和单个队列的访问策略无关。队列访问策略仅管控针对特定队列的操作（如发送、接收消息等），无法干预账户级别的列表查询操作。
• 权限需配置在Pod关联的IAM角色中：部署在EKS的SpringBoot应用，应通过IAM Roles for Service Accounts (IRSA) 为Pod绑定IAM角色。需要给该角色添加包含sqs:ListQueues权限的IAM策略，示例如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sqs:ListQueues",
            "Resource": "*"
        }
    ]
}

• 验证凭证配置：确认EKS Pod已正确关联具备上述权限的IAM角色，且SDK默认使用该角色的凭证（AmazonSQSClientBuilder.defaultClient()会自动从环境变量/实例元数据获取凭证，IRSA配置正确时会自动使用Pod角色的凭证）。

内容的提问来源于stack exchange，提问作者fmp