Vfrdtyky

What are the best practices to let consumers of my application post events to my application queue? Note: They will need only write access to allow them to post events to the queue.

One way I could do this is to create a user with no access to aws console (just programmatic API access) and with inline policy(example policy below) to only allow "SendMessage" for the resource. Are there any security issues in doing this? What is the best way to solve this use case?

{

   "Version": "2012-10-17",

   "Statement": [{

      "Effect": "Allow",

      "Action": "sqs:SendMessage",

      "Resource": "arn:aws:sqs:*:123456789012:MyAppQueue"

   }]

}

You can use IAM users to control access to SQS. But You can also write an API that the users call with their message and your API put the message in SQS. This will make it easier for you to enable/disable access to consumers, add rate limiting, do some validation on the message's content before sending it to SQS.

You could also use AWS API Gateway (and optionally AWS Lambda) instead of building and hosting your own API endpoint. (see this and this)

The best practice is to use an AWS Role with proper permissions for your application when accessing AWS services. In order to use roles, you application must be deployed in AWS.

As far as the implementation goes, the best option (in my opinion) would be to create an API that will deal with sending messages to the SQS:

• Create REST API using API Gateway and Lambda (for example, using Serverless framework)




• Add permissions to the Lambda function to allow sending messages to the SQS



• 
  Configure authentication for the API (recommended). The options are
  APIKEY, Cognito or custom authorizer.

With this scenario, your application will call the REST API passing all information needed to be sent to the SQS.

Another option would be to run your custom application in AWS under a service Role that has permission to write to the SQS.