Grant AWS Lambda Access to an SQS Queue

Grant AWS Lambda Access to an SQS Queue #

In order to grant a Lambda function access to an SQS queue, we have to attach an IAM policy to the function's execution role. The policy should grant permissions for all the Actions the function needs to perform on the queue.

For example, the following policy grants permissions for the most commonly used sqs actions on a specific sqs queue.

Copied!
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
              "sqs:SendMessage",
              "sqs:DeleteMessage",
              "sqs:ChangeMessageVisibility",
              "sqs:ReceiveMessage",
              "sqs:TagQueue",
              "sqs:UntagQueue",
              "sqs:PurgeQueue"
            ],
            "Resource": "arn:aws:sqs:YOUR_REGION:YOUR_ACCOUNT_NUMBER:YOUR_QUEUE_NAME"
        }
    ]
}

The Resource element is simply the SQS queue's ARN. It should look something like: arn:aws:sqs:us-east-1:123456789:my-queue once the real values are in place.

The actions your lambda function needs to perform on the queue are use case dependent.

You could set "sqs:*" for the Action element in the policy to grant full sqs access to the lambda function. However, it's best practice to grant an entity the least permissions that get the job done.

You can view a full list of the sqs Actions in the SQS actions table.

There is a Description column, which explains what each action does.

To attach a policy to the lambda function's execution role, you have to:

1. Open the AWS Lambda console and click on your function's name
2. Click on the Configuration tab and then click Permissions

3. Click on the function's role
4. Click on Add permissions and then click Create inline policy

5. In the JSON editor paste the following policy.

Copied!
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
              "sqs:SendMessage",
              "sqs:DeleteMessage",
              "sqs:ChangeMessageVisibility",
              "sqs:ReceiveMessage",
              "sqs:TagQueue",
              "sqs:UntagQueue",
              "sqs:PurgeQueue"
            ],
            "Resource": "arn:aws:sqs:YOUR_REGION:YOUR_ACCOUNT_NUMBER:YOUR_QUEUE_NAME"
        }
    ]
}

6. Click Review Policy and give your policy a name, then click Create policy

At this point the lambda function's role has been extended with a policy that grants access to some SQS actions on a specific queue.

Invoke your lambda function and verify whether it has access to the SQS queue.

If your function is still unable to access the SQS queue, try to increase the function's timeout by a second in the AWS console or simply add an extra print statement in the code and click the Deploy button.

If your lambda function still does not have access to the queue, expand the IAM policy you added to the function's role and edit it to look like the policy below.

Copied!
{
    "Version": "2012-10-17",
    "Statement": [
        {
          "Effect": "Allow",
          "Action": [
              "sqs:*"
            ],
          "Resource": "arn:aws:sqs:YOUR_REGION:YOUR_ACCOUNT_NUMBER:YOUR_QUEUE_NAME"
        }
    ]
}

The IAM policy above grants full access to an SQS queue. Your lambda function will be able to execute all SQS actions on the queue.

After you've updated the policy, try to invoke your lambda function again, it should have permissions to execute any action on the SQS queue.

After you verify which actions your lambda needs to run, you can make the IAM policy less permissive.

Further Reading #

• Grant AWS Lambda Access to an SNS Topic
• Grant AWS Lambda Access to SSM Parameter Store
• Grant AWS Lambda Access to Secrets Manager
• How to Grant AWS Lambda Access to an S3 Bucket
• Grant AWS Lambda Access to a Dynamodb Table
• Grant a Lambda Function access to CloudWatch Logs
• AWS CDK Tutorial for Beginners - Step-by-Step Guide
• How to use Parameters in AWS CDK