sqs-consumer icon indicating copy to clipboard operation
sqs-consumer copied to clipboard

Docs Missing Required IAM Permission

Open wjkr opened this issue 3 years ago • 0 comments

Describe the problem The README should include the sqs:ChangeMessageVisibility IAM permission. This permission is used by the following lines of code:

  • https://github.com/bbc/sqs-consumer/blob/v5.6.0/src/consumer.ts#L279
  • https://github.com/bbc/sqs-consumer/blob/v5.6.0/src/consumer.ts#L401

To Reproduce

Steps to reproduce the behaviour:

  1. Assume an IAM role that has the sqs:ReceiveMessage and sqs:DeleteMessage permissions for the relevant SQS queue, but not the sqs:ChangeMessageVisibility permission.
  2. Write code that creates a consumer for the SQS queue. Include a heartbeat interval and a handler that takes longer than that interval to complete (e.g. 30 second interval and handler that sleeps for a minute).
  3. Add a message to the queue.
  4. Run the code and observe the following error message on the heartbeat interval:
AccessDenied: Access to the resource https://sqs.<region>.amazonaws.com/ is denied.

Expected behaviour

The error is expected, you just need to add the sqs:ChangeMessageVisibility IAM permission.

wjkr avatar Oct 07 '21 06:10 wjkr