Queue Permissions

class AddPermissionCommand {
  constructor(input: AddPermissionCommandInput);
}

interface AddPermissionCommandInput {
  /** URL of the queue to modify */
  QueueUrl: string;
  /** Unique label for this permission (up to 80 characters) */
  Label: string;
  /** AWS account IDs to grant permissions to */
  AWSAccountIds: string[];
  /** Actions to allow (e.g., 'SendMessage', 'ReceiveMessage', '*') */
  Actions: string[];
}

import { SQSClient, AddPermissionCommand } from "@aws-sdk/client-sqs";

const client = new SQSClient({ region: "us-east-1" });

// Grant send permission to another account
await client.send(new AddPermissionCommand({
  QueueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/MyQueue",
  Label: "AllowCrossAccountSend",
  AWSAccountIds: ["111122223333"],
  Actions: ["SendMessage"]
}));

// Grant multiple permissions
await client.send(new AddPermissionCommand({
  QueueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/MyQueue", 
  Label: "AllowServiceAccess",
  AWSAccountIds: ["444455556666"],
  Actions: ["SendMessage", "ReceiveMessage", "DeleteMessage"]
}));

// Grant all permissions (use with caution)
await client.send(new AddPermissionCommand({
  QueueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/MyQueue",
  Label: "AllowFullAccess",
  AWSAccountIds: ["777788889999"],
  Actions: ["*"]
}));

class RemovePermissionCommand {
  constructor(input: RemovePermissionCommandInput);
}

interface RemovePermissionCommandInput {
  /** URL of the queue to modify */
  QueueUrl: string;
  /** Label of the permission to remove */
  Label: string;
}

// Remove specific permission
await client.send(new RemovePermissionCommand({
  QueueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/MyQueue",
  Label: "AllowCrossAccountSend"
}));

// Clean up expired permissions
const permissionsToRemove = ["TempAccess1", "TempAccess2"];
for (const label of permissionsToRemove) {
  await client.send(new RemovePermissionCommand({
    QueueUrl: queueUrl,
    Label: label
  }));
}

// Allow SNS service to send messages to SQS
await client.send(new AddPermissionCommand({
  QueueUrl: queueUrl,
  Label: "AllowSNSPublish",
  AWSAccountIds: ["123456789012"], // Your account ID
  Actions: ["SendMessage"]
}));

// Additional policy may be needed for SNS topic subscription
const snsPolicy = {
  Version: "2012-10-17",
  Statement: [{
    Effect: "Allow",
    Principal: {
      Service: "sns.amazonaws.com"
    },
    Action: "sqs:SendMessage",
    Resource: "arn:aws:sqs:us-east-1:123456789012:MyQueue",
    Condition: {
      ArnEquals: {
        "aws:SourceArn": "arn:aws:sns:us-east-1:123456789012:MyTopic"
      }
    }
  }]
};

// Producer account grants send permissions
await client.send(new AddPermissionCommand({
  QueueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/SharedQueue",
  Label: "AllowConsumerAccountReceive", 
  AWSAccountIds: ["999888777666"], // Consumer account
  Actions: ["ReceiveMessage", "DeleteMessage", "ChangeMessageVisibility"]
}));

// Consumer can now access the queue from their account
const consumerClient = new SQSClient({
  region: "us-east-1",
  credentials: consumerAccountCredentials
});

const messages = await consumerClient.send(new ReceiveMessageCommand({
  QueueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/SharedQueue"
}));

try {
  await client.send(new AddPermissionCommand({
    QueueUrl: queueUrl,
    Label: "TestPermission",
    AWSAccountIds: ["invalid-account-id"],
    Actions: ["SendMessage"]
  }));
} catch (error) {
  if (error.name === 'InvalidAddress') {
    console.error("Invalid AWS account ID format");
  } else if (error.name === 'OverLimit') {
    console.error("Too many permissions on this queue");
  }
}