Test SQS Queue access

[phuonghuynh]

@ronaldtse Atm the validation of the SQS connection only do one simple task (original version): read queue url from queue selected. It doesnt make sense if the credential has permission to read queue lists but has no access right to read & delete queue items which is required by the plugin, check the SQS permission list http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-api-permissions-reference.html

The plugin should ask user to send an item to the queue. When the item is verified by the user, it should be deleted. The validation should return success value if all operations are successful.

[ronaldtse]

I agree, however it is a bit complex to allow the right to "read" and "delete" from the queue because it requires the user to first populate one message to the queue.

On the other hand we can allow the account to "publish" to the queue and then test "read" and "delete", but then the "publish" permission is excessive.

I suppose we could add one more button to "Test CodeCommit Trigger SQS Read and Delete", and provide instructions on how to send a test item to the queue (e.g., via the CodeCommit Commit Trigger Test which would publish a message)?

[phuonghuynh]

@ronaldtse A simple way is that we can "try" to do some actions we need:

• Get Queue Urls
• Get Messages
• Delete Messages

By checking error code response, we are able to determine which Permission IAM user granted, i.e. 404 means that IAM user has access to the resource but the resource not existed; 403 means that the user is forbidden.

[ronaldtse]

@phuonghuynh agree. Let's make the "Access Test" more complete with trying multiple permissions via multiple actions. 👍

[phuonghuynh]

@ronaldtse the Plugin only need 2 permissions, Read and delete item from a Queue. But in the Queue config page, user must have "list queue" permission also. We dont need this permission when running trigger for job.
I think we let user select queue from the list or enter queue url if he doesnt have "list queue" permission. How do you think?

[ronaldtse]

@phuonghuynh I fully agree. But we should detect whether "list queue" permission is provided so as to switch between "list" and "manual entry" functionality, right?