AWS

More documents

Recommendations

Info

Amazon Simple Queue Service Developer Guide AWS IAM and SQS Policies Together It's up to you how you use both of the systems together to manage your permissions, based on your needs. The following examples show how the two policy systems work together. Example 1 In this example, Bob has both an AWS IAM policy and an SQS policy that apply to him. The AWS IAM policy gives him permission to use ReceiveMessage on queue_xyz, whereas the SQS policy gives him permission to use SendMessage on the same queue. The following diagram illustrates the concept. If Bob were to send a request to receive a message from queue_xyz, the AWS IAM policy would allow the action. If Bob were to send a request to send a message to queue_xyz, the SQS policy would allow the action. API Version 2009-02-01 65
Amazon Simple Queue Service Developer Guide Amazon SQS ARNs Example 2 In this example, we build on example 1 (where Bob has two policies that apply to him). Let's say that Bob abuses his access to queue_xyz, so you want to remove his entire access to that queue. The easiest thing to do is add a policy that denies him access to all actions on the queue. This third policy overrides the other two, because an explicit deny always overrides an allow (for more information about policy evaluation logic, see Evaluation Logic (p. 39)). The following diagram illustrates the concept. Alternatively, you could add an additional statement to the SQS policy that denies Bob any type of access to the queue. It would have the same effect as adding a AWS IAM policy that denies him access to the queue. For examples of policies that cover Amazon SQS actions and resources, see Example AWS IAM Policies for Amazon SQS (p. 68). For more information about writing SQS policies, go to the Amazon Simple Queue Service Developer Guide. Amazon SQS ARNs For Amazon SQS, queues are the only resource type you can specify in a policy. Following is the Amazon Resource Name (ARN) format for queues: arn:aws:sqs:region:account_ID:queue_name For more information about ARNs, go to ARNs in Using Identity and Access Management. API Version 2009-02-01 66
Page 1 and 2:
Amazon Simple Queue Service Develop
Page 3 and 4:
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100: Amazon Simple Queue Service Develop
Page 149: Amazon Simple Queue Service Develop
show all

AWS

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?