amazon-web-services - AWS SQS 队列未接收来自 SNS 主题订阅的消息

Question

在我的 cloudformation 模板中，我的 SQS 队列有以下内容:

OutputQueuePolicy:
  Type: AWS::SQS::QueuePolicy
  Properties:
    PolicyDocument:
      Statement:
        - Effect: "Allow"
          Principal: "*"
          Action:
            - "sqs:SendMessage"
          Resource:
            Fn::GetAtt: [OutputQueue, Arn]
          Condition:
            ArnEquals:
              aws:SourceArn: !Ref OutputTopic
            Bool:
              aws:SecureTransport: "false"
    Queues:
      - Ref: OutputQueue

OutputQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: isolation-change-output-queue
    RedriveAllowPolicy:
      redrivePermission: byQueue
      sourceQueueArns:
        - Fn::GetAtt: [OutputDeadLetterQueue, Arn]
    RedrivePolicy:
      deadLetterTargetArn:
        Fn::GetAtt: [OutputDeadLetterQueue, Arn]
      maxReceiveCount: 5

OutputDeadLetterQueuePolicy:
  Type: AWS::SQS::QueuePolicy
  Properties:
    PolicyDocument:
      Statement:
        - Effect: "Deny"
          Principal: "*"
          Action:
            - "sqs:SendMessage"
            - "sqs:ReceiveMessage"
          Resource: "*"
          Condition:
            Bool:
              aws:SecureTransport: "false"
    Queues:
      - Ref: OutputDeadLetterQueue

OutputDeadLetterQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: isolation-change-output-dead-letter-queue

这是我的 SNS 主题:

OutputTopicPolicy:
  Type: AWS::SNS::TopicPolicy
  Properties:
    PolicyDocument:
      Statement:
        - Sid: "Allow-SQS-to-receive-messages-from-topic"
          Effect: "Allow"
          Principal:
            Service: "sqs.amazonaws.com"
          Action: "sns:Publish"
          Resource:
            Ref: OutputTopic
          Condition:
            ArnEquals:
              "aws:SourceArn":
                Fn::GetAtt:
                  - OutputQueue
                  - Arn
    Topics:
      - Ref: OutputTopic

OutputTopic:
  Type: AWS::SNS::Topic
  Properties:
    TopicName: isolation-change-output-topic

OutputQueueSNSSubscription:
  Type: AWS::SNS::Subscription
  Properties:
    Endpoint:
      Fn::GetAtt: [OutputQueue, Arn]
    Protocol: "sqs"
    RedrivePolicy:
      deadLetterTargetArn:
        Fn::GetAtt: [OutputDeadLetterQueue, Arn]
    TopicArn: !Ref OutputTopic

我尝试通过 AWS SDK 将消息发布到该主题，但消息似乎没有进入队列。我没有收到任何错误，并且不确定我的 cloudformation 模板出了什么问题。

Answer 1

您的 Amazon SQS 队列需要访问策略，以允许 Amazon SNS 主题向 Amazon SQS 队列发送消息。

我部署了您的堆栈并将此策略添加到 SQS 队列中:

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:ap-southeast-2:111111111111:isolation-change-output-dead-letter-queue",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:sns:ap-southeast-2:111111111111:isolation-change-output-topic"
        }
      }
    }
  ]
}

然后，我能够成功向 SNS 主题发送消息，并且该消息出现在 SQS 队列中。

该政策复制自:Subscribing an Amazon SQS queue to an Amazon SNS topic - Amazon Simple Notification Service

您需要向 OutputDeadLetterQueuePolicy 添加类似的策略。