AWS IAM policy for Event-Bridge to SQS with deny

Question

I want to restrict my sqs to accept only from event-bridge rule, below IAM rule looks correct with deny in place, but sqs not receiving message with this, any input appreciated.

{   "Id": "Policy",   "Version": "2012-10-17",   "Statement": [
    {
      "Sid": "sid",
      "Action": [
        "sqs:SendMessage"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      },
      "Principal": "*"
    }   ] }

The one generated by Event-bridge to allow sqs access looks like this

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "AWSEvents_sri-test-sqs-rule_Id12",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:***:sri-test-queue-3",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule"
        }
      }
    }
  ]
}

Answer 1

Use the bottom policy. SQS policy denies by default, so you do not need to worry about other resources posting messages to SQS. The policy would allow only arn:aws:events:us-east-1:***:rule/sri-test-bus/sri-test-sqs-rule to send the messages.

The problem with the policy statement you wrote was that you did not have an "Allow" statement, so SQS is denying SendMessage actions from every source.

Answer 2

We just had to put some combination of principalTypes to achieve this, below one worked finally

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ownerstatement",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:xxxx:sri-test-queue-3"
    },
    {
      "Sid": "DenyAllExceptBus",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:xxxx:sri-test-queue-3",
      "Condition": {
        "ArnNotEquals": {
          "aws:SourceArn": [
            "arn:aws:events:us-east-1:xxxx:rule/sri-test-bus/sri-test-sqs-rule"
          ]
        }
      }
    }
  ]
}