Grant a Compute Service Access to an SQS Queue

Your compute service (Lambda, EC2, or ECS) is connected to an SQS queue, but its IAM role has no sqs:* permissions. The template deploys, but message operations fail at runtime. The actions you need depend on direction: a consumer (Lambda triggered by the queue) reads and deletes messages; a producer sends them. On the canvas, the compute→queue edge auto-generates the right policy. To do it by hand, use the steps below.

Paste into this field

IAM Role → permissions policy (or draw the edge on the canvas)

Output looks like

Canvas edge: Lambda → SQS (auto-generates an sqs:ReceiveMessage/DeleteMessage policy)

1Option A (recommended) — let CloudStack Canvas generate it

With no custom IAM Role node, drawing the compute→queue edge gives the auto-created role a scoped SQS policy. Re-export to clear the warning.

3Option B — fix the role in the AWS console and accept the warning

If you manage your own IAM Role node on the canvas, the validation warning will persist in CSC even after you add the policy in AWS. The warning is advisory — it alerts you that the canvas role node lacks these permissions. Add the policy below in AWS, and the template will deploy correctly; the canvas warning remains until you edit the canvas-based role definition.

5Paste a policy for your direction

CONSUMER (Lambda event source / polling the queue): use the policy below. PRODUCER (only sending): replace the actions with just "sqs:SendMessage" and "sqs:GetQueueAttributes". Replace REGION, ACCOUNT, my-queue.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "sqs:ReceiveMessage",
      "sqs:DeleteMessage",
      "sqs:GetQueueAttributes"
    ],
    "Resource": "arn:aws:sqs:REGION:ACCOUNT:my-queue"
  }]
}

8Save the policy

Name it AllowSQSAccess and click "Create policy". Note: if the Lambda is triggered by the queue, an event source mapping also requires these same receive/delete permissions.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide