AWS SQS Security

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
AWS	Amazon Web Services	亚马逊云服务
HTTPS	Hypertext Transfer Protocol Secure	使用 TLS 加密的 HTTP
IAM	Identity and Access Management	身份与访问管理
KMS	Key Management Service	密钥管理服务
SNS	Simple Notification Service	AWS 消息通知服务
SQS	Simple Queue Service	AWS 消息队列服务
SSE	Server-Side Encryption	服务端加密

1. IAM Producer Policy#

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSendToOrderQueue",
      "Effect": "Allow",
      "Action": [
        "sqs:SendMessage",
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl"
      ],
      "Resource": "arn:aws:sqs:ap-east-1:123456789012:prod-platform-checkout-order-payment-capture"
    }
  ]
}

2. IAM Consumer Policy#

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowConsumeOrderQueue",
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:ChangeMessageVisibility",
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl"
      ],
      "Resource": "arn:aws:sqs:ap-east-1:123456789012:prod-platform-checkout-order-payment-capture"
    }
  ]
}

Use this when an SNS topic publishes to SQS. Restrict by aws:SourceArn.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSnsTopicPublish",
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:ap-east-1:123456789012:prod-platform-checkout-order-payment-capture",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:sns:ap-east-1:123456789012:prod-platform-checkout-order-events"
        }
      }
    }
  ]
}

4. Encryption#

SSE-SQS:
    AWS managed encryption for SQS
    simple default for most queues

SSE-KMS:
    use customer managed KMS key
    better key policy / audit / rotation control
    producers and consumers need KMS permissions

important:
    encrypted queues require HTTPS and SigV4
    SSE encrypts message body
    queue metadata, message metadata, and metrics are not encrypted by SQS SSE

SQS SSE 保护消息正文，不等于队列访问授权；Queue policy、调用方 IAM 和适用的 KMS key policy 都要满足。

KMS key policy/role permissions must allow:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSqsKmsUsage",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:ap-east-1:123456789012:key/11111111-2222-3333-4444-555555555555"
    }
  ]
}

AWS SQS Security

1. IAM Producer Policy#

2. IAM Consumer Policy#

3. Queue Policy For SNS Fanout#

4. Encryption#