(sqs queue): ability to add secure transport condition

When adding a queue to cloudwatch events, I use add_target. However, it’s not straightforward to customize the resource policy that’s created. There’s an sqs queue policy with the principal get att to the cloudwatch rule, though no hook to expose the resource policy.

event_rule.add_target(event_targets.SqsQueue(queue))

Use Case

I need to add “aws:SecureTransport”.

Proposed Solution

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[0xjjoyy]

For now I just used addToResourcePolicy and for the principal applied to all events service principal. That works for now as all service principals should be using TLS for this use case. And it’s scoped to the account so no external access.

[frankwese]

enforce_tls_statement = iam.PolicyStatement( sid=“Enforce TLS for all principals”, effect=iam.Effect.DENY, principals=[ iam.AnyPrincipal(), ], actions=[ “sqs:*”, ], resources=[queue.queue_arn], conditions={ “Bool”: {“aws:secureTransport”: “false”}, }, )

There is a typo it has to be aws:SecureTransport not aws:secureTransport