无法使用配置的 SQS 策略验证 Cloudformation 中的以下目标配置以获取 S3 到 SQS 通知

Question

I get the status UPDATE_FAILED for an S3 bucket with logical ID MyBucket explained by the following status reason in the cloudformation console:

Unable to validate the following destination configurations (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument; Request ID: ABCDEFGHIJK; S3 Extended Request ID: Aqd2fih3ro981DED8wq48io9e51rSD5e3Fo3iw5ue31br; Proxy: null)

I have the following CloudFormation template:

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-bucket-name
      NotificationConfiguration:
        QueueConfigurations:
          - Event: s3:ObjectCreated:Put
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: jpg
            Queue: !GetAtt MyQueue.Arn

  MyQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: my-queue
      KmsMasterKeyId: alias/an-encryption-key
  
  MyQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref MyQueue
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com
            Action: SQS:SendMessage
            Resource: !GetAtt MyQueue.Arn
        
  EncryptionKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: '2012-10-17'
        Id: some-id
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: "kms:*"
            Resource: '*'
      KeyUsage: ENCRYPT_DECRYPT

  EncryptionKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/an-encryption-key
      TargetKeyId: !Ref EncryptionKey

What changes should I perform on the template in order to make the CloudFormation stack succeed? The status reason is too vague for me to understand what is going wrong. I know that it is related to the notification configuration because CloudFormation succeeds if I remove it. Other similar posts on Stackoverflow mention a missing or inaccurate queue policy, but since I have a queue policy I do not think that that is the problem.

Answer 1

The problem is that since server side encryption is enabled on the queue, S3 should be able to:

• let KMS generate an appropriate datakey
• be able to decrypt using the EncryptionKey

Add a statement with the S3 service as principal that allows the abovementioned actions:

- Effect: Allow         
  Principal:
    Service: s3.amazonaws.com
  Action:
    - kms:GenerateDataKey
    - kms:Decrypt
  Resource: "*"