sqs-dg-2009-02-01

Amazon Simple Queue Service Developer Guide
Element Descriptions
NotAction
The NotAction element is useful if you want to make an exception to a list of actions. You could use
this, for example, if you want your users to be able to use only the SQS SendMessage.
The following example refers to all actions other than the SQS SendMessage. You would use this in a
policy with "Effect":"Deny" to keep users from accessing any other actions.
"NotAction":"sqs:SendMessage"
Resource
The Resource is the object or objects the policy covers. The value can include a multi-character match
wildcard (*) or a single-character match wildcard (?) anywhere in the string. The values are free-form,
but must follow the format the AWS service expects. For example, for Amazon SQS, you specify a queue
in the following format: /<account ID of queue owner>/<queue name>. For example:
/987654321012/queue1.
"Resource":"/987654321000/queue2"
Condition
This section describes the Condition element and the information you can use inside the element.
The Condition Block
The Condition element is the most complex part of the policy statement. We refer to it as the condition
block, because although it has a single Condition element, it can contain multiple conditions, and each
condition can contain multiple key-value pairs. The following figure illustrates this. Unless otherwise
specified for a particular key, all keys can have multiple values.
When creating a condition block, you specify the name of each condition, and at least one key-value pair
for each condition. AWS defines the conditions and keys you can use (they're listed in the subsequent
sections). An example of a condition is NumericEquals. Let's say you have a fictional resource, and
you want to let John use it only if some particular numeric value foo equals either A or B, and another
numeric value bar equals C. Then you would create a condition block that looks like the following figure.
API Version 2009-02-01
50