如何让 lambda function 访问所有 SQS 队列？

Question

I have a lambda function that will be constantly running, and some SQS queues that will be dynamically created. I need a way to allow the lambda to access all of the SQS queues so that these dynamically created queues can be used - how can I do this?

Currently I am using an Execution role that has an iam policy with a single queue ARN, but it seems I can't create multiple execution roles.

Answer 1

EDIT

As mentioned in the comment below it may not be entirely safe to open up SQS queues to everything, so I will keep my initial solution below for interest but in general a better solution would be:

Create the lambda function with an iAM role attached that has access to all SQS queues. The policy for this would look something like

{
  "Version": "2012-10-17",
  "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "sqs:GetQueueUrl",
          "sqs:ChangeMessageVisibility",
          "sqs:ListDeadLetterSourceQueues",
          "sqs:SendMessageBatch",
          "sqs:PurgeQueue",
          "sqs:ReceiveMessage",
          "sqs:SendMessage",
          "sqs:GetQueueAttributes",
          "sqs:CreateQueue",
          "sqs:ListQueueTags",
          "sqs:ChangeMessageVisibilityBatch",
          "sqs:SetQueueAttributes"
        ],
        "Resource": "*"
      },
   ]
}

---

---

I initially managed to get around the problem by creating my SQS queues with permissions attached. When creating SQS queues you can assign a policy to them where you can specify permissions and users, for example the following policy allows all permissions to all users:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "SQS:*",
      "Resource": "{{ queue_arn }}"
    }
  ]
}