SQS optimistic create causes a permission denied issue

[jacobboland-ph]

We are looking to use this library, but are running into an issue with a permissions disconnect. Our use case is that we create a queue in separate infrastructure code that can be managed and we want to prevent our application from having access to create queues. Due to this, we are receiving an AccessDenied exception on the existing queue due to not having sqs:createqueue in our policy. Because it is a specific permissions issue, the QueueAlreadyExists exception code does not get caught.

Would it be possible to provide a configuration to trust an existing queue exists and not to create one?

[adenhertog]

hey @jacobboland-ph 👋

As you've noticed, the library currently tries to create queues, set permissions and manage sns subscriptions for fan out. This isn't always desirable when you're wanting to restrict permissions in production.

I think it should be an easy change to expose some configuration so it bypasses this infra setup. To help me understand better:

• you want to avoid having the app/library create the queue
• do manage the sns subscriptions externally too?
• do you also manage the queue policy externally?

If this is the case, and if you just want to run it with the smallest amount of app-level permissions eg: sns:Publish, sqs:ReceiveMessage then the config approach should be pretty straightforward.

[emmanuelmanyike]

@adenhertog I would like to open a proposal PR supporting the functionality that @jacobboland-ph is describing. Could you please grant me permission to push to the repo?

[jacobboland-ph]

Hi @adenhertog ! Thanks for the quick response. The answer to the bullets above are all yes.

As mentioned @emmanuelmanyike has a fix for this in a fork if that's preferred. We can work on putting up a PR.

[adenhertog]

sounds great - feel free to tag me in the PR from your fork and I'll check it out

[emmanuelmanyike]

@adenhertog Here is the PR please take a look.