Question

I’m currently working on a project which has a large amount of IAM users, each of whom need limited access to particular SQS queues.

For instance, let’s say I have an IAM user named ‘Bob’ and an SQS queue named ‘BobsQueue’. What I’d like to do is grant Bob full permission to manage his queue (BobsQueue), but I’d like to restrict his usage such that:

• Bob can make only 10 SQS requests per second to BobsQueue.
• Bob cannot make more than 1,000,000 SQS requests per month.

I’d essentially like to apply arbitrary usage restrictions to this SQS queue.

Any ideas?

Answer 1

From the top of my head none of the available AWS services offers resource usage limits at all, except if built into the service’s basic modus operandi (e.g. the Provisioned Throughput in Amazon DynamoDB) and Amazon SQS is no exception, insofar the Available Keys supported by all AWS services that adopt the access policy language for access control currently lack such resource limit constraints.

While I can see your use case, I think it’s actually more likely to see something like this see the light as an accounting/billing feature, insofar it would make sense to allow cost control by setting (possibly fine grained) limits for AWS resource usage – this isn’t available either yet though.

• Please note that this feature is frequently requested (see e.g. How to limit AWS resource consumption?) and it’s absence actually allows to launch what Christofer Hoff aptly termed an Economic Denial of Sustainability attack (see The Google attack: How I attacked myself using Google Spreadsheets and I ramped up a $1000 bandwidth bill for a somewhat ironic and actually non malicious example).

Workaround

You might be able to achieve an approximation of your specification by facilitating Shared Queues with an IAM policy granting access to user Bob as outlined in Example AWS IAM Policies for Amazon SQS and monitoring this queue with Amazon CloudWatch in turn by Creating Amazon CloudWatch Alarms for one or more of the Amazon SQS Dimensions and Metrics you want to limit, e.g. NumberOfMessagesSent. Once the limit is reached you could revoke the IAM grant for user Bob for this shared queue until he is in compliance again.

• Obviously it is not necessarily trivial to implement the ‘per second’/’per-month’ specification based on this metric alone without some thorough bookkeeping, nor will you be able to ‘pull the plug’ precisely when the limit is reached, rather need to account for the processing time and API delays.

Good luck!