When do I need an SQS queue policy?

You need a queue policy when AWS services (like SNS, S3, or EventBridge) need to send messages to your queue, or when principals in other AWS accounts need access. Without a policy, only the queue owner's account can interact with the queue.

What is the difference between an SQS queue policy and an IAM policy for SQS?

An SQS queue policy is a resource-based policy attached to the queue itself, specifying who can access it. An IAM policy is attached to a user, group, or role, specifying what that identity can do. Both are evaluated together to determine access.

AWS SQS Queue Policy Builder

IAM & SecurityAWS

Build SQS queue access policies with conditions for send and receive permissions.

SQS Queue Policy Configuration

Queue ARN

Statement 1

SID (optional)

Effect

Principal

Actions (comma-separated)

Condition Operator

Condition Key

Condition Value

Generated SQS Queue Policy

Output will appear here...

About This Tool

The SQS Queue Policy Builder provides a guided interface for creating access policies on Amazon SQS queues. SQS queue policies determine which AWS accounts, IAM principals, and services can send messages to or receive messages from your queues. This tool walks you through building policy statements with the correct actions, principals, and conditions, generating valid JSON you can apply via the console, CLI, or infrastructure-as-code tools.

When to Use This Tool

•Build a queue policy that allows SNS topics to send messages to your SQS queue for fan-out architectures.
•Create cross-account access policies that let other AWS accounts send messages to your queue securely.
•Configure a policy restricting queue access to specific VPC endpoints for network-level isolation.
•Generate a policy that allows S3 event notifications to deliver object-created events to your SQS queue.

Frequently Asked Questions

When do I need an SQS queue policy?: You need a queue policy when AWS services (like SNS, S3, or EventBridge) need to send messages to your queue, or when principals in other AWS accounts need access. Without a policy, only the queue owner's account can interact with the queue.
What is the difference between an SQS queue policy and an IAM policy for SQS?: An SQS queue policy is a resource-based policy attached to the queue itself, specifying who can access it. An IAM policy is attached to a user, group, or role, specifying what that identity can do. Both are evaluated together to determine access.

Related Learning Guides

AWS IAM Best Practices25 min read

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.