如何在AWS SQS隊列上添加權限？

Question

使用以下代碼，我可以使用我的AWS賬號添加權限，但隊列不會收到來自SNS的任何消息。

AddPermissionRequest addPermissionRequest = new AddPermissionRequest(); 
addPermissionRequest.ActionName.Add("SendMessage"); 
addPermissionRequest.ActionName.Add("ReceiveMessage"); 
addPermissionRequest.QueueUrl = queueUrl; 
addPermissionRequest.Label = General.IpAddressAWSFriendly; 
addPermissionRequest.AWSAccountId.Add(AWS_ACCOUNT_ID); 
sqs.AddPermission(addPermissionRequest); 

但是，當我嘗試通過爲大家通配符（*）設置權限：

addPermissionRequest.AWSAccountId.Add("*"); 

它給了我一個錯誤。如果我手動添加的權限在AWS SQS控制檯，並指定

SendMessage 
ReceiveMessage 

爲允許的動作和原則，我將它設置爲「大家」，隊列不接收我的SNS主題的消息。所以，顯然，我做錯了什麼，但我不再看到它。

任何幫助將是巨大的！我希望亞馬遜會有例子，SDK附帶的例子沒有顯示任何有關設置策略或權限的信息。在線文檔中也沒有顯示任何內容。令人沮喪。

Answer 1

幸運的是，我自己想清楚了，因爲我在這裏沒有收到任何回覆。我真的希望亞馬遜能爲.Net框架上的C＃開發人員提供更好的文檔，而不僅僅是爲腳本小子提供文檔。

無論如何，我最終創建了一個完整的Policy對象並將其傳遞給SQS。我使用的是AWS SDK v1.5版本，而不是更新的2.0版本（現在beta版本），只是因爲它現在可以工作，而且我懶得修改爲新的2.0版本。

這裏是代碼位則需要編程C＃創建一個策略的SQS隊列與條件，只使用隊列與SNS話題：

 // 4. Set the queue policy to allow SNS to publish messages 
     ActionIdentifier[] actions = new ActionIdentifier[2]; 
     actions[0] = SQSActionIdentifiers.SendMessage; 
     actions[1] = SQSActionIdentifiers.ReceiveMessage; 
     Policy sqsPolicy = new Policy() 
      .WithStatements(new Statement(Statement.StatementEffect.Allow) 
           .WithPrincipals(Principal.AllUsers) 
           .WithResources(new Resource(queueArn)) 
           .WithConditions(ConditionFactory.NewSourceArnCondition(_AWSSNSArn)) 
           .WithActionIdentifiers(actions)); 
     SetQueueAttributesRequest setQueueAttributesRequest = new SetQueueAttributesRequest(); 
     List<Amazon.SQS.Model.Attribute> attributes = new List<Amazon.SQS.Model.Attribute>(); 
     Amazon.SQS.Model.Attribute attribute = new Amazon.SQS.Model.Attribute(); 
     attribute.Name = "Policy"; 
     attribute.Value = sqsPolicy.ToJson(); 
     attributes.Add(attribute); 
     setQueueAttributesRequest.QueueUrl = queueUrl; 
     setQueueAttributesRequest.Attribute = attributes; 
     sqs.SetQueueAttributes(setQueueAttributesRequest); 

我希望這可以幫助別人。

Answer 2

以下是如何與amazonica做Clojure中：

(require '[amazonica.aws.sqs :as sqs] 
     '[amazonica.core :as aws) 
(import '(com.amazonaws.auth.policy Statement Statement$Effect 
            Principal 
            Policy 
            Resource 
            Condition 
            Action) 
     '(com.amazonaws.auth.policy.actions SQSActions) 
     '(com.amazonaws.auth.policy.conditions ConditionFactory)) 

(aws/defcredential "access-key" "secret-key" "us-east-1") 

(def topic-arn "arn:aws:sns:us-east-1:123:foo") 
(def queue-url "https://sqs.us-east-1.amazonaws.com/123/bar") 
(def queue-arn (-> queue-url sqs/get-queue-attributes :QueueArn)) 

(def policy (Policy. 
        (str queue-arn "/SQSDefaultPolicy") 
        [(doto (Statement. Statement$Effect/Allow) 
         (.setPrincipals [Principal/AllUsers]) 
         (.setResources [(Resource. queue-arn)]) 
         (.setConditions [(ConditionFactory/newSourceArnCondition topic-arn)]) 
         (.setActions [SQSActions/SendMessage]))])) 

(sqs/set-queue-attributes queue-url {"Policy" (.toJson policy)}) 

Answer 3

這是我如何與匿名即時創建隊列中讀取訪問。只需根據需要添加其他ActionIdentifiers：

public static String TestQueueCreate(String name) { 

     AmazonSQSClient sqs = new AmazonSQSClient(region: Amazon.RegionEndpoint.USEast1); 
     CreateQueueResponse create = sqs.CreateQueue(name); 

     Policy policy = new Policy() { 
      Statements = new List<Statement>() { 
       new Statement(StatementEffect.Allow) { 
        Principals = new List<Principal>() { Principal.AllUsers }, 
        Actions = new List<ActionIdentifier>() { SQSActionIdentifiers.ReceiveMessage } 
       } 
      } 
     }; 

     Dictionary<String,String> queueAttributes = new Dictionary<String, String>(); 
     queueAttributes.Add(QueueAttributeName.Policy.ToString(), policy.ToJson()); 
     sqs.SetQueueAttributes(new SetQueueAttributesRequest(create.QueueUrl, queueAttributes)); 

     return create.QueueUrl; 
    } 

Answer 4

以前創建的權限沒有資源沒有按預期工作。這裏有一個修正，以獲得阿爾恩：

public static String TestQueueCreate(String name) { 

     AmazonSQSClient sqs = new AmazonSQSClient(region: Amazon.RegionEndpoint.USEast1); 
     CreateQueueResponse create = sqs.CreateQueue(name); 

     String arn = sqs.GetQueueAttributes(create.QueueUrl, new List<String>() { "QueueArn" }).Attributes["QueueArn"]; 

     Policy policy = new Policy() { 
      Statements = new List<Statement>() { 
       new Statement(StatementEffect.Allow) { 
        Principals = new List<Principal>() { new Principal("*") }, 
        Actions = new List<ActionIdentifier>() { 
         new ActionIdentifier("SQS:ReceiveMessage"), 
         new ActionIdentifier("SQS:SendMessage") 
        }, 
        Resources = new List<Resource>() { new Resource(arn) } 
       } 
      }, 

     }; 

     Dictionary<String,String> queueAttributes = new Dictionary<String, String>(); 
     queueAttributes.Add(QueueAttributeName.Policy.ToString(), policy.ToJson()); 
     sqs.SetQueueAttributes(new SetQueueAttributesRequest(create.QueueUrl, queueAttributes)); 

     return create.QueueUrl; 
    }