aws / aws/chalice

Insufficient role permissions to call `sqs.get_queue_by_name(...)`

Open
#2,028 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
11.1k
Forks
1k
Avg merge
1d 22h
Merged PRs (30d)
2

Description

Use case: get (and work with) queue by name.

```python
sqs = boto3.resource('sqs')
queue = sqs.get_queue_by_name(...)
```

Problem: Error when executing code on Lambda due to missing "GetQueueUrl" permission in autogen policy.

- chalice local: can get queue normally. ✅
- chalice deploy: can't get queue. ❌

Workaround: Forcing autogen policy to attach `GetQueueUrl` via `sqs_client.get_queue_url(...)` API.

```python
sqs = boto3.resource('sqs')
sqs_client = boto3.client('sqs')
queue_url = sqs_client.get_queue_url(QueueName='')['QueueUrl']
queue = sqs.Queue(url=queue_url)
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the difference between `chalice local` and `chalice deploy` for `sqs.get_queue_by_name(...)`, then inspect the autogen policy handling for SQS resources. Verify the result by confirming that the deployed Lambda policy grants `GetQueueUrl` and that queue lookup by name works without the workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.