Unable to trigger aws sqs from aws lambda function

Question

I have an aws lambda function that needs to trigger an aws sqs but I always get the following message:

Fail Send MessageAccessDenied: Access to the resource https://sqs.eu-west-1.amazonaws.com/ is denied

This is my lambda:

var QUEUE_URL = 'https://sqs.eu-west-1.amazonaws.com/*****/*****'
var AWS = require('aws-sdk');
var sqs = new AWS.SQS({region : 'eu-west-1'});


exports.handler = function(event, context) {

  var params = {
    MessageBody: JSON.stringify(event),
    QueueUrl: QUEUE_URL
  };
  sqs.sendMessage(params, function(err,data){
    if(err) {
      console.log('error:',"Fail Send Message" + err);
      context.done('error', "ERROR Put SQS");  // ERROR with message
    } else{
      console.log('data:',data.MessageId);
      context.done(null,'');  // SUCCESS
    }
  });
}

Anybody any idea what the problem could be or a good resource for the aws.sqs? Do I need to pass credentials, and how do I set my queue url in aws.sqs?

Ashaman Kingpin · Accepted Answer · 2019-10-18 13:43:42Z

3

Do you have an execution role assigned to your Lambda function that allows it to send a message to the SQS queue? This article details how to do it, specifically the section, Setting up the IAM Role.

answered Oct 18, 2019 at 13:43

Ashaman Kingpin

1,5851 gold badge12 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

bleau83 Over a year ago

I just found the solution, I had to add permissions to my queue

Ashaman Kingpin Over a year ago

So you added a permission to your queue to allow your Lambda function to add messages to the queue? I guess that's one way to do it. Glad you found it!

jarmod Over a year ago

You would typically add the SQS queue permissions to the IAM role of the Lambda function, rather than adding permissions on the SQS queue resource itself, allowing the Lambda role to access the queue.

Ashaman Kingpin Over a year ago

@jarmod I agree and almost added that as a comment but although it appears to be a best practice, do you know why it is preferred over doing it in a resource policy?

jarmod Over a year ago

@AshamanKingpin The distinction here is between identity-based policies and resource-based policies. Not all services support resource-based policies, first of all. The key use cases for resource-based policies, in my opinion, are a) cross-account access so that the other user does not have assume an IAM role in your account and hence lose their own IAM permissions in the process and b) when you want to assert a fundamental policy across all users of the resource, such as "require encryption" or "restrict access to the following IP addresses".

Collectives™ on Stack Overflow

Unable to trigger aws sqs from aws lambda function

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related