无法在 S3 中配置 SQS 队列通知

Question

我创建了一个 SQS 队列并在权限选项卡下添加了策略，仅允许我的帐户用户配置配置通知

政策文件

{
  "Version": "2012-10-17",
  "Id": "arn:aws:sqs:us-east-1:111111111111:sqsqueue/SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "Sid111111111111",
      "Effect": "Allow",
      "Principal": {
        "AWS": "111111111111"
      },
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:111111111111:queue"
    }
  ]

导航到 S3 并尝试为上述队列配置事件通知，它抛出错误

无法验证以下目标配置。目标队列的权限不允许 S3 从该存储桶发布通知。(arn:aws:sqs:us-east-1:111111111111:queue)*

难道我做错了什么？有人能帮助我吗

Answer 1

我能够通过在 Principal 标签中添加 "Service": "s3.amazonaws.com" 来解决这个问题。

这里是政策文件

    {
  "Version": "2012-10-17",
  "Id": "arn:aws:sqs:us-east-1:111111111111:sqsqueue/SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "Sid111111111111",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": [
        "sqs:SendMessage",
        "sqs:ReceiveMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-1:111111111111:queue"
    }
  ]

这在https://forums.aws.amazon.com/thread.jspa?threadID=173251 中有解释

Answer 2

此模板文件创建一个存储桶、SQS 队列以及连接两者的策略：

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  IncomingBucketName:
    Type: 'String'
    Description: 'Incoming Bucket Name'
    Default: 'some-bucket-name-here'
Resources:
  IncomingFileQueue:
    Type: 'AWS::SQS::Queue'
    Properties: {}
  SQSQueuePolicy:
    Type: 'AWS::SQS::QueuePolicy'
    Properties:
      PolicyDocument:
        Id: 'MyQueuePolicy'
        Version: '2012-10-17'
        Statement:
          - Sid: 'Statement-id'
            Effect: 'Allow'
            Principal:
              AWS: "*"
            Action: 'sqs:SendMessage'
            Resource:
              Fn::GetAtt: [ IncomingFileQueue, Arn ]
      Queues:
        - Ref: IncomingFileQueue
  IncomingFileBucket:
    Type: 'AWS::S3::Bucket'
    DependsOn:
      - SQSQueuePolicy
      - IncomingFileQueue
    Properties:
      AccessControl: BucketOwnerFullControl
      BucketName:
        Ref: IncomingBucketName
      NotificationConfiguration:
        QueueConfigurations:
          - Event:
              s3:ObjectCreated:Put
            Queue:
              Fn::GetAtt: [ IncomingFileQueue, Arn ]

我遇到了同样的问题，但使用此页面来确定如何连接三个资源以成功部署堆栈： https://aws.amazon.com/premiumsupport/knowledge-center/unable-validate-destination-s3 /

我仍在研究保单条件，因为上述链接中推荐的表格不适用于 SQS。在这种情况下，上述模板不安全，不应在生产中使用，因为它允许任何人将消息添加到队列中。

一旦我弄清楚了这一点，我就会更新这个答案......