用于限制订阅的 Amazon SNS 策略不起作用

Question

我正在使用以下策略在帐户 A 中创建一个 SNS 主题：

{
     "Sid": "Give Access to Different Account Queues to subscribe to my topic",
     "Effect": "Allow",
     "Principal":{
       "AWS": "AccountId of Account B"
     },
     "Action": "sns:Subscribe",
     "Resource": "Arn of my SNS topic present in Account A",
     "Condition": {
       "StringEquals": {
          "sns:Protocol": "sqs"
       },
       "ForAllValues:StringEquals": {
          "sns:Endpoint": [
             "Arn of Queue A present in Account B", "Arn Queue B present in Account B"
          ]
       }
     }
  }

在帐户 A 中创建上述主题和策略后。然后，我通过控制台登录帐户 B 并尝试将队列 C 订阅到我的 SNS 主题，然后订阅也成功并且队列收到确认订阅的消息！但理想情况下，在上述政策之后，只有队列 A 和队列 B 应该能够订阅我的 SNS 主题。

Answer 1

您的政策对我来说非常有效，但我不得不将 Principal 更改为引用 arn:aws:iam::ACCOUNT-B:root。（我不记得我从哪里得到的，但它出现在某个阶段。）

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-B:root"
      },
      "Action": "sns:Subscribe",
      "Resource": "arn:aws:sns:ap-southeast-2:ACCOUNT-A:topic",
      "Condition": {
        "StringEquals": {
          "sns:Protocol": "sqs"
        },
        "ForAllValues:StringEquals": {
          "sns:Endpoint": [
            "arn:aws:sqs:ap-southeast-2:ACCOUNT-B:queue1",
            "arn:aws:sqs:ap-southeast-2:ACCOUNT-B:queue2"
          ]
        }
      }
    }
  ]
}

我可以从 queue1 和 queue2 订阅，但不能 queue3。

用于限制订阅的 Amazon SNS 策略不起作用

Amazon SNS Policy to restrict subscriptions is not working

cloud

amazon-sqs

amazon-web-services

amazon-sns

amazon-iam