awspring
SQS IAM Permissions incorrect for ARN listeners.
Type: Question
Component: SQS IAM documentation
Describe the bug According to the documentation To use SqsListener with Sqs name instead of ARN you will need sqs:GetQueueUrl
But I also had to grant this permission to be able to use @SqsListener("arn") or SQSTemplate.receiveMany("arn", Some.class).
Is the documentation incorrect and should be To use the queue by its name or ARN instead of the URL you will need: sqs:GetQueueUrl instead?
Hi @PatrickGotthard, thanks for bringing this up.
You're correct, the only situation where we don't need this permission is if the user provides the URL directly.
Would you like to contribute a PR with this change?
I just stumbled upon another "issue": do you know a use case where you only want to read the message but not delete (acknowledge) it?
Hmm, yeah, I can think of such an use case.
For instance, you might want to read the message every e.g. 5 minutes until something happens.
But it might be useful to say explicitly that we need the delete permission to acknowledge messages.
What do you think?
But even then you want to acknowledge the message "when something happens" or not? Strange use case but yes, we should mention that the delete permission is required to acknowledge messages. I'll create a pull request asap.