Spring Cloud AWS SQS AccessDenied

Question

I am currently having a connection issue trying to connect to an AWS SQS Queue using Spring Cloud and Spring Boot. I believe I have everything configured fine but am getting:

2015-07-01 18:12:11,926 [WARN][-] org.springframework.boot.context.embedded.AnnotationConfigEmbeddedWebApplicationContext[487] - Exception encountered during context initialization - cancelling refresh attempt org.springframework.context.ApplicationContextException: Failed to start bean 'simpleMessageListenerContainer'; nested exception is com.amazonaws.AmazonServiceException: Access to the resource https://sqs.us-west-2.amazonaws.com/{Number}/{Queue Name} is denied. (Service: AmazonSQS; Status Code: 403; Error Code: AccessDenied; Request ID: 87312428-ec0f-5990-9f69-6a269a041b4d)

@Configuration
@EnableSqs
public class CloudConfiguration {
    private static final Logger log = Logger.getLogger(CloudConfiguration.class);

    @MessageMapping("QUEUE")
    public void retrieveProvisionMessages(User user) {
        log.warn(user.firstName);
    }
}

YML

cloud:
    aws:
       credentials.accessKey: AccessKey
       credentials.secretKey: SecretKey
       region.static: us-west-2
       credentials.instanceProfile: true

When it attempts to connect I see that a header value of:

AWS4-HMAC-SHA256 Credential=accesskey/20150701/us-west-2/sqs/aws4_request, SignedHeaders=host;user-agent;x-amz-date, Signature=signature

After the request is sent:

HTTP/1.1 403 Forbidden [Server: Server, Date: Wed, 01 Jul 2015 22:51:25 GMT, Content-Type: text/xml, Content-Length: 349, Connection: keep-alive, x-amzn-RequestId: Request Id] org.apache.http.conn.BasicManagedEntity@37e55df6

I have checked all AIM policies and they are correct.

Using:

private AmazonSQS establishQueue(){
    AmazonSQS sqs = new AmazonSQSClient(new BasicAWSCredentials(accessKey, secretKey));
    sqs.setRegion(RegionUtils.getRegion(region));
    return sqs;
}


    AmazonSQS sqs = establishQueue();
    return sqs.receiveMessage(sqs.getQueueUrl(userProductPurchase).getQueueUrl());

with the same credentials works fine. Any help is greatly appreciated.

Thanks

Abelabelard

Answer 1

Do you have GetQueueAttributes calls allowed for your IAM user?

I think it's using also few more operations. Not only ReceiveMessage and GetQueueUrl.

Fribourg

Yes I have completely opened up all access while testing. Again using the AWS SDK everything works fine, just can't connect with the Spring Cloud components. – Abelabelard

Can you try GetQueueAttributes with AWS SDK too? I don't think you can get access denied when everything is allowed. – Fribourg

This solved my problem :D i thought receive messages permission was enough – Jacie

Answer 2

In my case, using Spring Cloud, I had to set the following permissions up:

• sqs:DeleteMessage
• sqs:GetQueueUrl
• sqs:ReceiveMessage
• sqs:SendMessage
• sqs:GetQueueAttributes

Krefetz