Search code examples
amazon-web-servicesaws-cloudformationamazon-sqs

Why does my sqs access policy statement is overwritten instead of adding another policy?


I have a sqs queue, which has an existing sqs access policy.

I am trying to add another policy statement inside the existing policy, but running my cloudformation template results in overwriting the existing policy with the new policy.

 DlqSqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub name
      KmsMasterKeyId: alias/aws/sqs
      KmsDataKeyReusePeriodSeconds: 86400
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  DlqSqsQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev1
                    - Arn

            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v1
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue

  DlqSqsQueuePolicyV2:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev2
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v2
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue

Solution

  • An SQS queue can have only one AWS::SQS::QueuePolicy. You have to take your Statement from DlqSqsQueuePolicyV2 and add it to DlqSqsQueuePolicy:

     DlqSqsQueue:
        Type: AWS::SQS::Queue
        Properties:
          QueueName: !Sub name
          KmsMasterKeyId: alias/aws/sqs
          KmsDataKeyReusePeriodSeconds: 86400
        UpdateReplacePolicy: Delete
        DeletionPolicy: Delete
    
      DlqSqsQueuePolicy:
        Type: AWS::SQS::QueuePolicy
        Properties:
          PolicyDocument:
            Statement:
              - Action: sqs:SendMessage
                Condition:
                  ArnEquals:
                    aws:SourceArn:
                      Fn::GetAtt:
                        - rulenamev1
                        - Arn
    
                Effect: Allow
                Principal:
                  Service: events.amazonaws.com
                Resource:
                  Fn::GetAtt:
                    - DlqSqsQueue
                    - Arn
                Sid: v1
              - Action: sqs:SendMessage
                Condition:
                  ArnEquals:
                    aws:SourceArn:
                      Fn::GetAtt:
                        - rulenamev2
                        - Arn
                Effect: Allow
                Principal:
                  Service: events.amazonaws.com
                Resource:
                  Fn::GetAtt:
                    - DlqSqsQueue
                    - Arn
                Sid: v2            
            Version: '2012-10-17'
          Queues:
            - Ref: DlqSqsQueue