Menu
Amazon Simple Queue Service
Developer Guide

Amazon SQS API Permissions: Actions and Resource Reference

When you set up Access Control and write permissions policies that you can attach to an IAM identity, you can use the following table as a reference. The table lists each Amazon Simple Queue Service API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions.

Specify the actions in the policy's Action field, and the resource value in the policy's Resource field. To specify an action, use the sqs: prefix followed by the API operation name (for example, sqs:CreateQueue).

Currently, Amazon SQS supports only a limited subset of the condition keys available in IAM:

  • aws:CurrentTime

  • aws:EpochTime

  • aws:SecureTransport

  • aws:SourceArn

  • aws:SourceIP

  • aws:UserAgent

  • aws:MultiFactorAuthAge

  • aws:MultiFactorAuthPresent

  • aws:TokenAge

If you see an expand arrow () in the upper-right corner of the table, you can open the table in a new window. To close the window, choose the close button (X) in the lower-right corner.

Amazon Simple Queue Service API and Required Permissions for Actions

Amazon SQS API Operations Required Permissions (API Actions) Resource

AddPermission

sqs:AddPermission

arn:aws:sqs:region:account_id:queue_name

ChangeMessageVisibility

sqs:ChangeMessageVisibility arn:aws:sqs:region:account_id:queue_name

ChangeMessageVisibilityBatch

sqs:ChangeMessageVisibilityBatch arn:aws:sqs:region:account_id:queue_name

CreateQueue

sqs:CreateQueue arn:aws:sqs:region:account_id:queue_name

DeleteMessage

sqs:DeleteMessage arn:aws:sqs:region:account_id:queue_name

DeleteMessageBatch

sqs:DeleteMessageBatch arn:aws:sqs:region:account_id:queue_name

DeleteQueue

sqs:DeleteQueue arn:aws:sqs:region:account_id:queue_name

GetQueueAttributes

sqs:GetQueueAttributes arn:aws:sqs:region:account_id:queue_name

GetQueueUrl

sqs:GetQueueUrl arn:aws:sqs:region:account_id:queue_name

ListDeadLetterSourceQueues

sqs:ListDeadLetterSourceQueues arn:aws:sqs:region:account_id:queue_name

ListQueues

sqs:ListQueues arn:aws:sqs:region:account_id:*

PurgeQueue

sqs:PurgeQueue arn:aws:sqs:region:account_id:queue_name

ReceiveMessage

sqs:ReceiveMessage arn:aws:sqs:region:account_id:queue_name

RemovePermission

sqs:RemovePermission arn:aws:sqs:region:account_id:queue_name

SendMessage

sqs:SendMessage arn:aws:sqs:region:account_id:queue_name

SendMessageBatch

SetQueueAttributes

sqs:SetQueueAttributes arn:aws:sqs:region:account_id:queue_name