如何为 S3 事件编写加密 SQS 的策略声明？

Question

我有一个 SQS 队列，使用具有以下策略文档。用于从存储桶接收 S3 事件：

{
  "Version": "2008-10-17",
  "Id": "example-ID",
  "Statement": [
    {
      "Sid": "example-statement-ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    }
  ]
}

现在，我已经为队列启用了服务器端加密（SSE）。而且，我已经按照 this doc 编写了加密策略声明。现在的政策声明如下所示：

{
  "Version": "2008-10-17",
  "Id": "example-ID",
  "Statement": [
    {
      "Sid": "example-statement-ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ],
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:<>:cypher-queue",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:*:*:cypher-secondarybucket"
        }
      }
    }
  ]
}

但是现在，队列没有从存储桶中获取有关文件添加的任何消息。 我的权限有问题吗？

Answer 1

我错过了 same article 的以下公告。我犯了一个非常愚蠢的错误。将需要等待将 S3 事件发送到加密的 SQS。

The following features of AWS services aren't currently compatible with encrypted queues:

Amazon CloudWatch Events

Amazon S3 Event Notifications

Amazon SNS Topic Subscriptions

Auto Scaling Lifecycle Hooks

AWS IoT Rule Actions

AWS Lambda Dead-Letter Queues

Answer 2

这现在成为可能。来自 AWS 文档：

https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html#grant-destinations-permissions-to-s3 在 AWS KMS 密钥策略

部分下

If the SQS queue is SSE enabled, you can attach the following key policy to the associated AWS Key Management Service (AWS KMS) customer managed customer master key (CMK). The policy grants the Amazon S3 service principal permission for specific AWS KMS actions that are necessary for to encrypt messages added to the queue.
{
    "Version": "2012-10-17",
    "Id": "example-ID",
    "Statement": [
        {
            "Sid": "example-statement-ID",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}

如何为 S3 事件编写加密 SQS 的策略声明？

How do I write the policy statement of an encrypted SQS for S3 events?

permissions

amazon-s3

amazon-sqs

amazon-web-services

aws-kms