具有IAM角色的AWS sqs限制为ec2 [英] AWS sqs limit to ec2 with iam role

问题描述

我有一个SQS，我想限制对允许发送/接收的服务的访问.

I have an SQS to which i want to limit the access of services allowed to send/receive.

阅读并试用后，我发现应该可以通过使用SQS上的访问策略来做到这一点.

After reading and trying out I have found that this should be doable by using an Access Policy on the SQS.

我写的政策:

"Version": "2012-10-17",
  "Id": "arn:aws:sqs:eu-west-1:123456789:HACKsqs03/SQSDefaultPolicy",
  "Statement": [
{
  "Sid": "Sid456789",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789:role/HACKiam01"
  },
  "Action": "SQS:ReceiveMessage",
  "Resource": "arn:aws:sqs:eu-west-1:123456789HACKsqs03"
},
{
  "Sid": "Sid123456",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789:role/HACKiam02"
  },
  "Action": "SQS:SendMessage",
  "Resource": "arn:aws:sqs:eu-west-1:123456789:HACKsqs03"
}
]

此政策附于SQS.

将这两个角色添加到我用于测试的两个不同的EC2实例中.现在两者都仍然能够发送和接收消息.我不知道为什么吗?

The two roles where added to two different EC2 instances which i used for testing. Now both where still able to send and receive messages. I can't figure out why?

我的政策有误吗?还是我误解了文档?

Is my policy wrong? Or am I misunderstanding the documentation?

澄清:我需要一个政策，允许一个实例/安全组/iam-role发送消息，并允许一个实例/sg/iam-role接收.

Clarification: I need a policy that allows one instance/securitygroup/iam-role to sendmessage and one instance/sg/iam-role to receive.

推荐答案

还有其他明确允许使用的策略.感谢Jonh Rotenstein向我指出了正确的方向:

There are other policies explicitly allowing things. Thanks to Jonh Rotenstein for pointing me in the right direction:

后续问题

这篇关于具有IAM角色的AWS sqs限制为ec2的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！