Menu
Amazon Simple Queue Service
Developer Guide

Amazon SQS API Permissions: Actions and Resource Reference

When you set up Access Control and write permissions policies that you can attach to an IAM identity, you can use the following table as a reference. The table lists each Amazon Simple Queue Service API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions.

Specify the actions in the policy's Action field, and the resource value in the policy's Resource field. To specify an action, use the sqs: prefix followed by the API operation name (for example, sqs:CreateQueue).

Currently, Amazon SQS supports only a limited subset of the condition keys available in IAM:

  • aws:CurrentTime

  • aws:EpochTime

  • aws:SecureTransport

  • aws:SourceArn

  • aws:SourceIP

  • aws:UserAgent

  • aws:MultiFactorAuthAge

  • aws:MultiFactorAuthPresent

  • aws:TokenAge

If you see an expand arrow () in the upper-right corner of the table, you can open the table in a new window. To close the window, choose the close button (X) in the lower-right corner.

Amazon Simple Queue Service API and Required Permissions for Actions

Amazon SQS API OperationsRequired Permissions (API Actions)Resource

AddPermission

sqs:AddPermission

arn:aws:sqs:region:account_id:queue_name

ChangeMessageVisibility

sqs:ChangeMessageVisibilityarn:aws:sqs:region:account_id:queue_name

ChangeMessageVisibilityBatch

sqs:ChangeMessageVisibilityBatcharn:aws:sqs:region:account_id:queue_name

CreateQueue

sqs:CreateQueuearn:aws:sqs:region:account_id:queue_name

DeleteMessage

sqs:DeleteMessagearn:aws:sqs:region:account_id:queue_name

DeleteMessageBatch

sqs:DeleteMessageBatcharn:aws:sqs:region:account_id:queue_name

DeleteQueue

sqs:DeleteQueuearn:aws:sqs:region:account_id:queue_name

GetQueueAttributes

sqs:GetQueueAttributesarn:aws:sqs:region:account_id:queue_name

GetQueueUrl

sqs:GetQueueUrlarn:aws:sqs:region:account_id:queue_name

ListDeadLetterSourceQueues

sqs:ListDeadLetterSourceQueuesarn:aws:sqs:region:account_id:queue_name

ListQueues

sqs:ListQueuesarn:aws:sqs:region:account_id:*

PurgeQueue

sqs:PurgeQueuearn:aws:sqs:region:account_id:queue_name

ReceiveMessage

sqs:ReceiveMessagearn:aws:sqs:region:account_id:queue_name

RemovePermission

sqs:RemovePermissionarn:aws:sqs:region:account_id:queue_name

SendMessage

sqs:SendMessagearn:aws:sqs:region:account_id:queue_name

SendMessageBatch

sqs:SendMessageBatcharn:aws:sqs:region:account_id:queue_name

SetQueueAttributes

sqs:SetQueueAttributesarn:aws:sqs:region:account_id:queue_name