title: AWS default Access Policy SNS topics and SQS q's
body: <p>In an attempt to further tighten the security of our solution we are now looking at the used SNS topics and SQS queues. All our components live in the same AWS account.</p>
  
  <p>For starters we want to restrict the access to the SQS queues based on IP. So only requests coming from our NAT Gateway IP will be allowed. We don't allow anonymous access to our SQS queues.</p>
  
  <p>But there seems no way to achieve this as the creator of the SQS queues - the AWS account id - has access per default. So you can't create an effective permission for another user in the same AWS account id. As this newly created user, user2, will fall under the same AWS account id, with the same set of permissions.</p>
  
  <p>Am I correct in my understanding that all users in the same AWS account id have access per default to all created SQS queues as long as their IAM policy permits it?  And is my assumption right that the same behavior goes for the SNS topics?</p>
  
  <p>Below is the policy I would like the implement. Beside this policy I have no other policies active for this SQS q. But it is not honoring the source IP condition. I still can connect from everywhere when I use a correct AWS access key/secret combination. Only when I set the AWS principal to * - everyone - the policy seems effective.</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Id": "arn:aws:sqs:eu-west-1:4564645646464564:madcowtestqueue/SQSDefaultPolicy",
    "Statement": [
      {
        "Sid": "Sid1589365989662",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::4564645646464564:user/user2"
        },
        "Action": [
          "SQS:DeleteMessage",
          "SQS:SendMessage",
          "SQS:ReceiveMessage"
        ],
        "Resource": "arn:aws:sqs:eu-west-1:143631359317:madcowtestqueue",
        "Condition": {
          "IpAddress": {
            "aws:SourceIp": "1.1.1.1"
          }
        }
      }
    ]
  }
  </code></pre>
  
  <p>Reference:</p>
  
  <ul>
  <li><p><a href="https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-using-identity-based-policies.html" rel="nofollow noreferrer">Using identity-based policies with Amazon SQS - Amazon Simple Queue Service</a></p></li>
  <li><p><a href="https://docs.aws.amazon.com/sns/latest/dg/sns-using-identity-based-policies.html" rel="nofollow noreferrer">Using identity-based policies with Amazon SNS - Amazon Simple Notification Service</a></p></li>
  </ul>