amazon-web-services - 为什么我的 sqs 访问策略语句被覆盖而不是添加另一个策略？

Question

我有一个 sqs 队列，它有一个现有的 sqs 访问策略。

我尝试在现有策略中添加另一个策略声明，但运行我的 cloudformation 模板会导致新策略覆盖现有策略。

 DlqSqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub name
      KmsMasterKeyId: alias/aws/sqs
      KmsDataKeyReusePeriodSeconds: 86400
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  DlqSqsQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev1
                    - Arn

            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v1
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue

  DlqSqsQueuePolicyV2:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev2
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v2
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue

Answer 1

一个 SQS 队列只能有一个 AWS::SQS::QueuePolicy。您必须从 DlqSqsQueuePolicyV2 获取 Statement 并将其添加到 DlqSqsQueuePolicy:

 DlqSqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub name
      KmsMasterKeyId: alias/aws/sqs
      KmsDataKeyReusePeriodSeconds: 86400
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  DlqSqsQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev1
                    - Arn

            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v1
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev2
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v2            
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue