(aws-sqs): Granting "send message" doesn't grant SendMessageBatch privileges

Granting “send message” doesn’t grant sqs:SendMessageBatch privileges.

Reproduction Steps

queue = sqs.Queue(
    self, "items",
    visibility_timeout=core.Duration.seconds(300),
)
queue.grant_send_messages(lambdaFunction)

What did you expect to happen?

I expected that all SQS API actions for sending messages would be included in the inline policy attached to the Lambda function’s role.

What actually happened?

Only sqs:SendMessage, sqs:GetQueueAttributes, and sqs:GetQueueUrl were granted to the Lambda function.

       {
            "Action": [
                "sqs:SendMessage",
                "sqs:GetQueueAttributes",
                "sqs:GetQueueUrl"
            ],
            "Resource": "arn:aws:sqs:us-east-1:489466759351:whatsnew-app-items07D08F4B-L3JMVWUZHL4G",
            "Effect": "Allow"
        }

Environment

• CDK CLI Version : 1.104.0 (build 44d3383)
• Framework Version:
• Node.js Version: v16.1.0
• OS : MacOS
• Language (Version): Python 3.7

Other

---

This is 🐛 Bug Report

[troyaws]

I don’t think the ability to send one message per API call or 10 messages per API call is a privilege difference. I wouldn’t expect that to be an issue for a “least privilege” approach.

If you buy that argument, then I think the module should take the approach that makes it easiest on the developer and just grant all of the API actions that allow SendMessage. The other approaches you proposed are more complicated for users of the batch API. If you chose to take the approach of grantSendBatch, the GetQueueUrl and GetQueueAttributes actions should be included in the resultant policy.

[github-actions[bot]]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.