# How to grant access to SQS in Serverless.yml

**URL:** <https://forum.serverless.com/t/how-to-grant-access-to-sqs-in-serverless-yml/2525>\
**Category:** Serverless Framework\
**Created:** [August 18, 2017, 5:38am UTC](https://forum.serverless.com/t/how-to-grant-access-to-sqs-in-serverless-yml/2525 "2017-08-18T05:38:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hackman](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/hackman/32/1727_2.png) [@hackman](https://forum.serverless.com/u/hackman)\
**Post date:** [August 18, 2017, 5:38am UTC](https://forum.serverless.com/t/how-to-grant-access-to-sqs-in-serverless-yml/2525/1 "2017-08-18T05:38:12Z")

</div>

I am trying to grant access to a SQS queue thru the serverless.yml. Below is applicable part of serverless.yml granting permission (I’ve changed my id and queue name for obvious reasons). Am I formatting the arn improperly somehow?

provider:  
name: aws  
runtime: python3.6

iamRoleStatements:  
- Effect: "Allow"  
Action:  
- “sqs:SendMessage”  
- “sqs:GetQueueUrl”  
- "sqs:ListQueues"  
Resource: “arn:aws:sqs:us-east-1:000000000000:MyQueue.fifo”

#### If I use this wildcard resource it works without error

#### Resource: “arn:aws:sqs:us-east-1:_:_”

If I use the commented wildcard Resource line instead the code works. The Python code throwing the error is:  
for queue in sqs.queues.all():  
print(queue.url)

The error being thrown is:  
“errorMessage”: “An error occurred (AccessDenied) when calling the ListQueues operation: Access to the resource [https://queue.amazonaws.com/](https://queue.amazonaws.com/) is denied.”,  
“errorType”: “ClientError”

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [August 21, 2017, 11:22am UTC](https://forum.serverless.com/t/how-to-grant-access-to-sqs-in-serverless-yml/2525/2 "2017-08-21T11:22:05Z")

</div>

See [http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-api-permissions-reference.html](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-api-permissions-reference.html)

You need to grant `sqs:ListQueues` to `arn:aws:sqs:region:account_id:*` while the other permissions can be granted to individual queues.

---

<div class="post-metadata">

**Author:** ![hackman](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/hackman/32/1727_2.png) [@hackman](https://forum.serverless.com/u/hackman)\
**Post date:** [September 2, 2017, 11:49pm UTC](https://forum.serverless.com/t/how-to-grant-access-to-sqs-in-serverless-yml/2525/3 "2017-09-02T23:49:26Z")

</div>

@buggy thanks for the response. That is correct. I had found it in the documentation. It makes sense that you would need permission to all the queues in order to list them out. I refactored my application so I don’t use that method anymore thus reducing the rights the role needs in order to execute the function.