I'm working on an application that moves files from an sftp server to an AWS S3 bucket using an SQS message queue. Currently, the application is working but the permission policies in the template don't match what I would expect.
The template.yaml for the 'producer' application looks like this:
- Effect: "Allow"
Action:
- kms:Encrypt
- kms:Decrypt
Resource: "arn:aws:kms:${aws.region}:${aws.account}:key/${kms.key}"
- Effect: "Allow"
Action:
- s3:GetObject
- s3:ListBucket
- s3:PutObject
Resource:
- arn:aws:s3:::${aws.prefix}.${environment}.${functionalArea.lowerCase}.${integrationId.lowerCase}/*
- Effect: "Allow"
Action:
- sqs:SendMessage
- sqs:SendMessageBatch
- sqs:GetQueueUrl
Resource: !ImportValue 'lambda-sftp-to-s3:${environment}:SftpToS3QueueArn'
The consumer application has the following permissions:
- Effect: "Allow"
Action:
- kms:Encrypt
- kms:Decrypt
- kms:GenerateDataKey
Resource: "arn:aws:kms:${aws.region}:${aws.account}:key/${kms.key}"
- Effect: "Allow"
Action:
- sqs:GetQueueAttributes
- sqs:ReceiveMessage
- sqs:DeleteMessage
- sqs:GetQueueUrl
Resource: !Join [':',['arn:aws:sqs:${aws.region}:${aws.account}',!Ref QueueName]]
- Effect: "Allow"
Action:
- s3:GetObject
- s3:PutObject
Resource:
- arn:aws:s3:::esint.${environment}.*
- arn:aws:s3:::${aws.prefix}.${environment}.*
This setup is working. The message gets dispatched and the file gets moved from sftp to S3 as requested. However, according the this: https://repost.aws/knowledge-center/sqs-accessdenied-errors documentation the 'producer' is supposed to have the definition for the GenerateDataKey permission.
How is the application able to function correctly with the permissions 'reversed' like this? Are there any pitfalls or potential problems with this arrangement I need to be aware of?
