IAM Policy variables not recognised - ${cognito-identity.amazonaws.com:sub} - amazon-web-services

Question

I am trying to create a solution where every client that will use my service will have a sqs (which is in my AWS account). So in order that the client will be able to send messages and read messages from the queue, I want to use cognito with a single role that has variables, as there is a limitation on the number of roles that a single account can have.
I have created cognito user pool with an application, also created federated identity, role, policy and linked everything together.
the policy is
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"sqs:DeleteMessage",
"sqs:GetQueueUrl",
"sqs:DeleteMessageBatch",
"sqs:SendMessageBatch"
],
"Resource": [
"arn:aws:sqs:us-east-1:XXXX:test-${cognito-identity.amazonaws.com:sub}",
"arn:aws:sqs:us-east-1:XXXX:test"
]
}
]
}
the test client code is
const cognitoUser = userPool.getCurrentUser();
cognitoUser.getSession((err, session) => {
console.log(`session token: ${session.getIdToken().getJwtToken()}`);
const paramsCredentials = {
IdentityPoolId: 'XXXX',
Logins: {}
};
AWS.config.region = 'XXXX';
paramsCredentials.Logins[
`cognito-idp.${AWS.config.region}.amazonaws.com/XXXX`
] = session.getIdToken().getJwtToken();
AWS.config.credentials = new AWS.CognitoIdentityCredentials(
paramsCredentials
);
AWS.config.credentials.get(err => {
if (err) {
console.log(`got error - getting credentials. error: ${err}`);
}
const id = AWS.config.credentials.identityId;
console.log('Cognito Identity ID ' + id);
const sqs = new AWS.SQS({
region: AWS.config.region
});
const params = {
QueueName: 'test-9ea2b895-2971-4ee2-b372-451bf2b19731'
};
sqs.getQueueUrl(params, (err, data) => {
if (err) {
console.log(`got error getting url for queue, error: ${err}`);
} else {
console.log(`SQS url = ${data.QueueUrl}`);
}
});
});
});
and I am getting an error of
AWS.SimpleQueueService.NonExistentQueue: The specified queue does not exist or you do not have access to it.
Blockquote
But when I change the queue to the test one, all is working fine. I have double checked the sub and it is the correct id
What did i do wrong?

Answer 1

${cognito-identity.amazonaws.com:sub} IAM policy variable will return region:uuid your queue name will be test-us-east-1:9ea2b895-2971-4ee2-b372-451bf2b19731 which is a invalid SQS queue name(colon not allowed). So, it is not possible to restrict access to a queue named after that identity but you can create a policy limited to only a specific set of users of your application
Here is a blog from AWS on Understanding Amazon Cognito Authentication Part 3: Roles and Policies
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"sqs:DeleteMessage",
"sqs:GetQueueUrl",
"sqs:DeleteMessageBatch",
"sqs:SendMessageBatch"
],
"Resource": [
"arn:aws:sqs:us-east-1:XXXX:test"
]
"Condition": {
"StringEquals": {
"cognito-identity.amazonaws.com:sub": [
"us-east-1:12345678-1234-1234-1234-123456790ab"
]
}
}
}
]
}