Limit SQS permissions only to those really needed

loggly · MichalChomo · Feb 10, 2020 · Feb 7, 2020 · Feb 7, 2020 · f33eb9a1bb3b91153b5ea37a09944797b1116f19
commit f33eb9a1bb3b91153b5ea37a09944797b1116f19
diff --git a/AWSscripts/SQS3script.py b/AWSscripts/SQS3script.py
@@ -30,7 +30,12 @@ class AWS:
               "Principal": {
                 "AWS": "arn:aws:iam::%(account_number)s:root"
               },
-              "Action": "SQS:*",
+              "Action": [
+                "sqs:ReceiveMessage",
+                "sqs:GetQueueUrl",
+                "sqs:GetQueueAttributes",
+                "sqs:DeleteMessage"
+              ],
               "Resource": "%(queue_arn)s"
         }
         """
@@ -73,7 +78,10 @@ class AWS:
     {
         "Effect": "Allow",
         "Action": [
-            "sqs:*"
+            "sqs:ReceiveMessage",
+            "sqs:GetQueueUrl",
+            "sqs:GetQueueAttributes",
+            "sqs:DeleteMessage"
         ],
         "Resource": [
             "%(queue_arn)s"