如何编写用于S3事件的加密SQS策略声明？

Question

如何编写用于S3事件的加密SQS策略声明？

amazon-web-servicesamazon-s3permissionsamazon-sqsamazon-kms

7

我有一个SQS队列，它曾经有以下策略文档，用于接收来自存储桶的S3事件:

{
  "Version": "2008-10-17",
  "Id": "example-ID",
  "Statement": [
    {
      "Sid": "example-statement-ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    }
  ]
}

现在，我已经为队列启用了服务端加密（SSE）。我按照this doc的说明编写了加密策略声明。现在，策略声明看起来像这样：

{
  "Version": "2008-10-17",
  "Id": "example-ID",
  "Statement": [
    {
      "Sid": "example-statement-ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ],
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    }
  ]
}

但现在，队列在文件添加时没有从桶中获取任何消息。权限方面是否有什么问题？

- Dawny33

1

尝试重现您的场景时，我无法将事件通知添加到加密的SQS队列中。它返回了一个内部错误消息。但是，我怀疑您从 SQS文档中复制的策略应该放在发送消息的IAM用户上，而不是SQS队列本身上。 - John Rotenstein

@JohnRotenstein 是的。这是我的一个愚蠢错误。我没有注意到SSE启用的队列不支持S3事件。现在我已经自己回答了 :) - Dawny33

2个回答

4

我错过了同一篇文章中的以下公告，这是我的一个非常愚蠢的错误。需要等待将S3事件发送到加密SQS队列。

以下AWS服务功能目前与加密队列不兼容： Amazon CloudWatch Events Amazon S3 Event Notifications Amazon SNS Topic Subscriptions Auto Scaling Lifecycle Hooks AWS IoT Rule Actions AWS Lambda Dead-Letter Queues

- Dawny33

啊！好的，这也解释了我遇到的错误！ - John Rotenstein

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- dustin.schultz · Accepted Answer

现在这是可能的。根据AWS文档：https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#grant-destinations-permissions-to-s3 在AWS KMS密钥策略部分下可以实现。

If the SQS queue is SSE enabled, you can attach the following key policy to the associated AWS Key Management Service (AWS KMS) customer managed customer master key (CMK). The policy grants the Amazon S3 service principal permission for specific AWS KMS actions that are necessary for to encrypt messages added to the queue.

{
    "Version": "2012-10-17",
    "Id": "example-ID",
    "Statement": [
        {
            "Sid": "example-statement-ID",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}