Home Why does my sqs access policy statement is overwritten instead of adding another policy?

Questions

Why does my sqs access policy statement is overwritten instead of adding another policy?

February 15, 2023

I have a sqs queue, which has an existing sqs access policy.

I am trying to add another policy statement inside the existing policy, but running my cloudformation template results in overwriting the existing policy with the new policy.

 DlqSqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub name
      KmsMasterKeyId: alias/aws/sqs
      KmsDataKeyReusePeriodSeconds: 86400
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  DlqSqsQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev1
                    - Arn

            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v1
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue

  DlqSqsQueuePolicyV2:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev2
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v2
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue

>Solution :

An SQS queue can have only one AWS::SQS::QueuePolicy. You have to take your Statement from DlqSqsQueuePolicyV2 and add it to DlqSqsQueuePolicy:

 DlqSqsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub name
      KmsMasterKeyId: alias/aws/sqs
      KmsDataKeyReusePeriodSeconds: 86400
    UpdateReplacePolicy: Delete
    DeletionPolicy: Delete

  DlqSqsQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      PolicyDocument:
        Statement:
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev1
                    - Arn

            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v1
          - Action: sqs:SendMessage
            Condition:
              ArnEquals:
                aws:SourceArn:
                  Fn::GetAtt:
                    - rulenamev2
                    - Arn
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Resource:
              Fn::GetAtt:
                - DlqSqsQueue
                - Arn
            Sid: v2            
        Version: '2012-10-17'
      Queues:
        - Ref: DlqSqsQueue