AWS sqs limit to ec2 with iam role

Question

I have an SQS to which i want to limit the access of services allowed to send/receive.

After reading and trying out I have found that this should be doable by using an Access Policy on the SQS.

The policy i wrote:

"Version": "2012-10-17",
  "Id": "arn:aws:sqs:eu-west-1:123456789:HACKsqs03/SQSDefaultPolicy",
  "Statement": [
{
  "Sid": "Sid456789",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789:role/HACKiam01"
  },
  "Action": "SQS:ReceiveMessage",
  "Resource": "arn:aws:sqs:eu-west-1:123456789HACKsqs03"
},
{
  "Sid": "Sid123456",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789:role/HACKiam02"
  },
  "Action": "SQS:SendMessage",
  "Resource": "arn:aws:sqs:eu-west-1:123456789:HACKsqs03"
}
]

This policy i attached to the SQS.

The two roles where added to two different EC2 instances which i used for testing. Now both where still able to send and receive messages. I can't figure out why?

Is my policy wrong? Or am I misunderstanding the documentation?

Clarification: I need a policy that allows one instance/securitygroup/iam-role to sendmessage and one instance/sg/iam-role to receive.

Answer 1

There are other policies explicitly allowing things. Thanks to Jonh Rotenstein for pointing me in the right direction:

Follow up question