CloudWatch Event that targets SQS Queue fails to w

问题:

According to this article it's possible to set SQS as target for scheduled CloudWatch event:

https://aws.amazon.com/ru/about-aws/whats-new/2016/03/cloudwatch-events-now-supports-amazon-sqs-queue-targets/

I've created a simple Cloud Formation template that aims to trigger CloudWatch event each minute so the new message should appear in SQS, but something is missing as there are no messages in SQS.

The code:

{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "stack 1",
"Parameters": {

},
"Resources": {
    "MyQueue": {
        "Type": "AWS::SQS::Queue",
        "Properties": {
            "QueueName": "MyQueue"
        }
    },
    "MyRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "RoleName": "MyRole",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [{
                    "Effect": "Allow",
                    "Principal": {
                        "Service": ["events.amazonaws.com", "lambda.amazonaws.com"]
                    },
                    "Action": "sts:AssumeRole"
                }]
            },
            "Path": "/",
            "Policies": [{
                "PolicyName": "CloudWatchPolicy",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Effect": "Allow",
                        "Action": "*",
                        "Resource": "*"
                    }]
                }
            }]
        }
    },
    "MyRule": {
        "Type": "AWS::Events::Rule",
        "Properties": {
            "Description": "A rule to schedule data update",
            "Name": "MyRule",
            "ScheduleExpression": "rate(1 minute)",
            "State": "ENABLED",
            "RoleArn": {
                "Fn::GetAtt": ["MyRole",
                "Arn"]
            },
            "Targets": [{
                "Arn": {
                    "Fn::GetAtt": ["MyQueue",
                    "Arn"]
                },
                "Id": "MyRule"
            }]
        }
    }
},
"Outputs": {

}

}

What can be wrong there? Should I add a queue listener to make messages appear?

Question #2:

Docs about CloudWatch Event Rule Target declare that Id is a required field:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-target.html

Though AWS::SQS::Queue has no such property at all (only Name is present):

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html#aws-properties-sqs-queues-prop

What should be put to CloudWatch Event Rule Target Id property when SQS is used as a target?

Many thanks in advance.

回答1:

The missing piece in my template was AWS::SQS::QueuePolicy.

The working template:

    {
     "AWSTemplateFormatVersion": "2010-09-09",
     "Description": "stack 1",
     "Parameters": {},
     "Resources": {
        "MyPolicy": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "PolicyDocument": {
                    "Statement": [{
                        "Action": "sqs:*",
                        "Effect": "Allow",
                        "Resource": {
                            "Fn::GetAtt": ["MyQueue",
                            "Arn"]
                        }
                    }],
                    "Version": "2012-10-17"
                },
                "PolicyName": "MyPolicyName",
                "Roles": [{
                    "Ref": "MyRole"
                }]
            }
        },
        "MyRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [{
                        "Action": "sts:AssumeRole",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": ["events.amazonaws.com",
                            "sqs.amazonaws.com"]
                        }
                    }],
                    "Version": "2012-10-17"
                }
            }
        },
        "MyQueue": {
            "Type": "AWS::SQS::Queue",
            "Properties": {
                "QueueName": "MyQueue2"
            }
        },
        "MyRule": {
            "Type": "AWS::Events::Rule",
            "Properties": {
                "Description": "A rule to schedule data update",
                "Name": "MyRule",
                "ScheduleExpression": "rate(1 minute)",
                "State": "ENABLED",
                "RoleArn": {
                    "Fn::GetAtt": ["MyRole",
                    "Arn"]
                },
                "Targets": [{
                    "Arn": {
                        "Fn::GetAtt": ["MyQueue",
                        "Arn"]
                    },
                    "Id": "MyRule1",
                    "Input": "{\"a\":\"b\"}"
                }]
            }
        },
        "MyQueuePolicy": {
            "DependsOn": ["MyQueue", "MyRule"],
            "Type": "AWS::SQS::QueuePolicy",
            "Properties": {
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Id": "MyQueuePolicy",
                    "Statement": [{                     
                        "Effect": "Allow",
                        "Principal": {
                            "Service": ["events.amazonaws.com",
                            "sqs.amazonaws.com"]
                        },
                        "Action": "sqs:SendMessage",
                        "Resource": {
                            "Fn::GetAtt": ["MyQueue",
                            "Arn"]
                        }
                    }]
                },
                "Queues": [{
                    "Ref": "MyQueue"
                }]
            }
        }
    },
    "Outputs": {        
    }
}