AWS SQS - SpringBoot - 403 禁止

Question

我正在嘗試從部署在 AWS/eks 上的 SpringBoot 應用程序訪問 AWS SQS 列表，但我收到 403 Forbidden 作為錯誤。

我是否必須添加特定於 AWS SQS 訪問策略的內容才能授予作為生產者/消費者的客戶端訪問權限？

到目前為止，我並沒有嘗試進入隊列，我只想查看隊列列表。

提前致謝

pom.xml

...
<dependency>
    <groupId>com.amazonaws</groupId>
    <artifactId>aws-java-sdk-sqs</artifactId>
</dependency>

AwsSqsController.java

...
public ResponseEntity<ListQueuesResult> readQueueList() {
    AmazonSQS sqs = AmazonSQSClientBuilder.defaultClient();
    ListQueuesResult listOfQueues = sqs.listQueues();
    log.info("List of Queues: {}", listOfQueues);
    return ResponseEntity.ok(listOfQueues);
}

AWS SQS 訪問策略

 { "Version": "2012-10-17", "Id": "HCDQueuePolicy", "Statement": [ { "Sid": "AlwaysEncrypted", "Effect": "Deny", "Principal": { "AWS": "*" }, "Action": "sqs:*", "Resource": "arn:aws:sqs:us-east-1:X:queue-name", "Condition": { "Bool": { "aws:SecureTransport": "false" } } }, { "Sid": "DenyAppOperatorEngineer", "Effect": "Deny", "Principal": { "AWS": "arn:aws:iam::X:role/role-name" }, "Action": "sqs:SetQueueAttributes", "Resource": "arn:aws:sqs:us-east-1:X:queue-name" }, { "Sid": "AlwaysSameOrg", "Effect": "Deny", "Principal": { "AWS": "*" }, "Action": "sqs:*", "Resource": "arn:aws:sqs:us-east-1:X:queue-name", "Condition": { "Bool": { "aws:PrincipalIsAWSService": "false" }, "StringNotEquals": { "aws:PrincipalOrgID": "00000000000" } } }, { "Sid": "QueueProducerAccess", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::X:role/role-name" }, "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:us-east-1:X:queue-name", "Condition": { "StringEquals": { "aws:sourceVpce": "vpce-X00000" } } }, { "Sid": "QueueConsumerAccessViaVpcEndpoint", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::X:role/role-name" }, "Action": [ "sqs:ReceiveMessage", "sqs:GetQueueAttributes", "sqs:DeleteMessage" ], "Resource": "arn:aws:sqs:us-east-1:X:queue-name", "Condition": { "StringEquals": { "aws:sourceVpce": "vpce-X00000" } } }, { "Sid": "QueueConsumerAccessNotViaVpcEndpoint", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::X:role/role-name" }, "Action": [ "sqs:ReceiveMessage", "sqs:GetQueueAttributes", "sqs:DeleteMessage" ], "Resource": "arn:aws:sqs:us-east-1:X:queue-name" }, { "Sid": "QueueAdminAccess", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::X:role/role-name" }, "Action": "sqs:PurgeQueue", "Resource": "arn:aws:sqs:us-east-1:X:queue-name" }, { "Sid": "Allow S3 notifications", "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:us-east-1:X:queue-name", "Condition": { "StringEquals": { "aws:SourceAccount": "X" } } } ] }

Answer 1

這是我見過的最大的 sqs 政策 :D 這是由某個框架自動生成的 :) 嗎？

是的，您必須明確允許從隊列中讀取。

如果我沒記錯的話，那就是

    "sqs:ReceiveMessage",
    "sqs:GetQueueAttributes",
    "sqs:DeleteMessage" Actions 

您在 2 個地方擁有它，所以首先我會檢查是否滿足這些操作的條件。

如果您可以控制該政策，我會：

1. 復制它
2. 慢慢刪除安全，直到你可以連接
3. 找出您最初無法連接的原因（必須打自己的額頭：）
4. 添加已刪除的安全性