Aws-sdk-php: Amazon SQS keeps returning a 403 error

[Supacoco]

Hi there,

No matter what I do with the SqsClient, it keeps throwing a SqsException with error code 403.

I've double checked the key and the secret key I provided to the SqsClient. I also ensured it wasn't a problem of firm's proxy or firewall.

Find below the error message I got :

AWS Error Code: AccessDenied, Status Code: 403, AWS Request ID: > a8156b52-2952-53fa-87d3-2043726a2bb8, AWS Error Type: client, AWS Error > Message: Access to the resource https://sqs.us-west-2.amazonaws.com/ is > denied., User-Agent: aws-sdk-php2/2.3.4 Guzzle/3.6.0 curl/7.25.0 PHP/5.4.3

I'm feeling really dumb for not being able to achieve the first step...

What seems strange here it's that I tried with the aws-php-sdk sample projet and it worked fine.

[jeremeamia]

I'm sorry that you are have a hard time with this, and I'd definitely like to help. To start, can you share the code you are using to instantiate the SQS client? (Please replace any sensitive information, like credentials, with fake data.)

[Supacoco]

Hello jeremeamia thanks for your reply.

Please find below the piece of code I use to instantiate the SQS Client.

require 'vendor/autoload.php';
use Aws\Sqs\SqsClient;

$config = array(
  'key'    => 'my-key',
  'secret' => 'my-secret',
  'region' => 'us-west-2',
  'curl.options' => array(
    CURLOPT_PROXY => '10.10.10.10:1337',
    )
  );

$sqs = SqsClient::factory($config);

And then I try to create a queue:

$result = $sqs->createQueue(array('QueueName' => 'test-queue'));
print_r($result->get('QueueUrl');

[jeremeamia]

If you are sure that your keys are correct, then here are a few things that I would look into.

• If your user is an IAM user, please make sure that the user's permissions allow you to create queues.
• You are using version 2.3.4 of the SDK. The latest is 2.4.11. I suggest that you update your SDK.
• The proxy configuration may not be right. Also, you should take a look at the blog post by @mtdowling: Sending requests through a proxy. He describes a way to configure the proxy that is slightly different than how you are doing it.
• The proxy may be doing something weird to the request. You can see what the SDK is sending over the wire by attaching the wire logger to your client. If you have some way to compare that to what your proxy sends out, then you could see if they are different.

[Supacoco]

Hello jeremeamia,

Sorry for the lack of feedback, I wasn't able to solve this issue without being at the office.

I'm now using the lastest version of the SDK. I also switched to @mtdowling way to declare proxy configuration.
Unfortunately, I still have the forbidden error. That might point out that this issue stem from the firm's proxy.

I'm waiting for a network administrator to check what the proxy sends out and then compare both requests.

I'll keep you posted.

Thanks a lot.

[Supacoco]

You were right, the account I was using wasn't allowed to access SQS.

Thanks a lot for your time and patience :)

[muhammad-sannan-confiz]

I able to access sqs console from the browser, is there any thing extra that I am missing to access the sqs.
M trying to push a message from my lambda to sqs. Here is the exception.
PS IAM policy that m using has the access right on lambda for sqs.

{
"errorMessage": "Access to the resource https://sqs.us-west-2.amazonaws.com/ is denied. (Service: AmazonSQS; Status Code: 403; Error Code: AccessDenied; Request ID: c61c0698-505c-50fe-8c67-5602cb84e824)",
"errorType": "com.amazonaws.services.sqs.model.AmazonSQSException",
"stackTrace": [
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1543)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1181)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:962)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:675)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:649)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:632)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$300(AmazonHttpClient.java:600)",
"com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:582)",
"com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:446)",
"com.amazonaws.services.sqs.AmazonSQSClient.doInvoke(AmazonSQSClient.java:1504)",
"com.amazonaws.services.sqs.AmazonSQSClient.invoke(AmazonSQSClient.java:1480)",
"com.amazonaws.services.sqs.AmazonSQSClient.listQueues(AmazonSQSClient.java:1010)",
"com.amazonaws.services.sqs.AmazonSQSClient.listQueues(AmazonSQSClient.java:1022)",
"S3EventHandler.handleRequest(S3EventHandler.java:76)",
"S3EventHandler.handleRequest(S3EventHandler.java:28)"
]
}

[muhammad-sannan-confiz]

hi,

I found out the issue, IAM policy that i was using has access to only east region where as my sqs was on west. So before using sqs from lambda make sure you have correct policy attached.

[Prateek13727]

Hello folks,

Also please check the SNS topic in your SQS policy. In my case, the SNS topic in my SQS queue policy was different from the one from which was publishing the messages to my SQS queue.

you can view your SQS queue policy by clicking on the Edit button on the corresponding. queue detail page.