Using aws cli to add send message permission for SQS - amazon-web-services

Question

I'm trying to set up an existing SQS Queue as a subscriber to an SNS topic. In the AWS console in the permissions tab, I can set the policy document to
{
"Version": "2012-10-17",
"Id": "arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue/SQSDefaultPolicy",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "sqs:SendMessage",
"Resource": "arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue",
"Condition": {
"ArnEquals": {
"aws:SourceArn": "arn:aws:sns:us-east-1:7670234568007:new_posts"
}
}
}
]
}
How can I do this using the aws-cli

Answer 1

This is an practical example of how to do it using set-queue-attributes:
cat >/tmp/sqs_polcy << EOL
{
"Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue\/SQSDefaultPolicy\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"sqs:SendMessage\",\"Resource\":\"arn:aws:sqs:us-east-1:7670234568007:stdsourcequeue\",\"Condition\":{\"ArnEquals\":{\"aws:SourceArn\":\"arn:aws:sns:us-east-1:7670234568007:new_posts\"}}}]}"
}
EOL
aws sqs set-queue-attributes \
--queue-url https://<your-queue-url> \
--attributes file:///tmp/sqs_polcy
Above I create /tmp/sqs_polcy file with the policy, which is required for the set-queue-attributes command.
Your policy must be stringified from json, before you can use in the CLI command.

Answer 2

These are generally managed via the CLI command of add-permission for SQS.
However as you're using your own custom policy the AWS documentation states the following
AddPermission generates a policy for you. You can use SetQueueAttributes to upload your policy.
This would be accessible via the set-queue-attributes function.
Your policy will need to be be converted into a JSON file, against the key value of Policy.
As a word of caution by doing this it will replace the policy attached to your SQS queue, so make sure to validate it before hand.