Queue permissions

Grant producers permission to send, consumers permission to receive and acknowledge, and administrators permission to change queue settings. Batch message endpoints use the same actions as their single-message counterparts.

Actions

The endpoint reference describes request fields and responses. This table maps each call to its IAM action.

Call	Required action
`GET /v1/queues`	`queue:ListQueues`
`POST /v1/queues`	`queue:CreateQueue`
`GET /v1/queues/{queue_id}`	`queue:DescribeQueue`
`PATCH /v1/queues/{queue_id}`	`queue:UpdateQueue`
`DELETE /v1/queues/{queue_id}`	`queue:DeleteQueue`
`POST /v1/queues/{queue_id}/purge`	`queue:PurgeQueue`
`GET /v1/queues/{queue_id}/messages`	`queue:PeekMessages`
`POST /v1/queues/{queue_id}/messages`	`queue:SendMessage`
`DELETE /v1/queues/{queue_id}/messages`	`queue:DeleteMessage`
`POST /v1/queues/{queue_id}/messages/batch`	`queue:SendMessage`
`POST /v1/queues/{queue_id}/messages/receive`	`queue:ReceiveMessage`
`POST /v1/queues/{queue_id}/messages/delete-batch`	`queue:DeleteMessage`
`POST /v1/queues/{queue_id}/messages/visibility`	`queue:ChangeMessageVisibility`
`POST /v1/queues/{queue_id}/messages/visibility-batch`	`queue:ChangeMessageVisibility`

Resource scope

List and create authorize against *. Actions on an existing queue authorize against its CRN, crn:queue:<region>:<account>:queue/<name>.

Receiving and acknowledgment are separate

A consumer usually needs queue:ReceiveMessage, queue:DeleteMessage, and queue:ChangeMessageVisibility. Receiving alone does not grant permission to acknowledge a message or extend its lease. queue:PeekMessages is a separate permission for inspection without leasing. queue:PurgeQueue deletes the queue’s messages. It is independent of queue:DeleteQueue, which deletes the queue itself. Metric charts use telemetry:ReadMetrics in the selected account and region.

Example policy

This policy grants only the listed collection reads. It does not grant permission to send messages or manage resources.

{
  "version": "2024-01-01",
  "statements": [
    {
      "effect": "allow",
      "actions": [
        "queue:ListQueues"
      ],
      "resources": [
        "*"
      ]
    }
  ]
}

See IAM policies for policy evaluation and Queue for the service overview.

Get started

Products

Platform

Help

Queue permissions

Actions

Resource scope

Receiving and acknowledgment are separate

Example policy

​Actions

​Resource scope

​Receiving and acknowledgment are separate

​Example policy

Actions

Resource scope

Receiving and acknowledgment are separate

Example policy