feat(aws-sqs): improvements to IAM grants API

packages/@aws-cdk/aws-sqs/lib/queue-ref.ts

@@ -110,6 +110,93 @@ export abstract class QueueRef extends cdk.Construct implements s3n.IBucketNotif
       dependencies: [ this.policy! ]
     };
   }
+
+  /**
+   * Grant permissions to consume messages from a queue
+   *
+   * This will grant the following permissions:
+   *
+   *   - sqs:ChangeMessageVisibility
+   *   - sqs:ChangeMessageVisibilityBatch
+   *   - sqs:DeleteMessage
+   *   - sqs:ReceiveMessage
+   *   - sqs:DeleteMessageBatch
+   *   - sqs:GetQueueAttributes
+   *   - sqs:GetQueueUrl
+   *
+   * @param identity Principal to grant consume rights to
+   * @param queueActions additional queue actions to allow
+   */
+  public grantConsumeMessages(identity?: iam.IPrincipal, ...queueActions: string[]) {
+    this.grant(identity,
+      'sqs:ReceiveMessage',
+      'sqs:ChangeMessageVisibility',
+      'sqs:ChangeMessageVisibilityBatch',
+      'sqs:GetQueueUrl',
+      'sqs:DeleteMessage',
+      'sqs:DeleteMessageBatch',
+      'sqs:GetQueueAttributes',
+      ...queueActions);
+  }
+
+  /**
+   * Grant access to send messages to a queue to the given identity.
+   *
+   * This will grant the following permissions:
+   *
+   *  - sqs:SendMessage
+   *  - sqs:SendMessageBatch
+   *  - sqs:GetQueueAttributes
+   *  - sqs:GetQueueUrl
+   *
+   * @param identity Principal to grant send rights to
+   * @param queueActions additional queue actions to allow
+   */
+  public grantSendMessages(identity?: iam.IPrincipal, ...queueActions: string[]) {
+    this.grant(identity,
+      'sqs:SendMessage',
+      'sqs:SendMessageBatch',
+      'sqs:GetQueueAttributes',
+      'sqs:GetQueueUrl',
+      ...queueActions);
+  }
+
+  /**
+   * Grant an IAM principal permissions to purge all messages from the queue.
+   *
+   * This will grant the following permissions:
+   *
+   *  - sqs:PurgeQueue
+   *  - sqs:GetQueueAttributes
+   *  - sqs:GetQueueUrl
+   *
+   * @param identity Principal to grant send rights to
+   * @param queueActions additional queue actions to allow
+   */
+  public grantPurge(identity?: iam.IPrincipal, ...queueActions: string[]) {
+    this.grant(identity,
+      'sqs:PurgeQueue',
+      'sqs:GetQueueAttributes',
+      'sqs:GetQueueUrl',
+      ...queueActions);
+  }
+
+  /**
+   * Grant the actions defined in queueActions to the identity Principal given
+   * on this SQS queue resource.
+   *
+   * @param identity Principal to grant right to
+   * @param queueActions The actions to grant
+   */
+  public grant(identity?: iam.IPrincipal, ...queueActions: string[]) {
+      if (!identity) {
+        return;
+      }
+
+      identity.addToPolicy(new iam.PolicyStatement()
+        .addResource(this.queueArn)
+        .addActions(...queueActions));
+  }
 }
 
 /**

packages/@aws-cdk/aws-sqs/lib/queue.ts

@@ -1,7 +1,5 @@
-import iam = require('@aws-cdk/aws-iam');
 import kms = require('@aws-cdk/aws-kms');
 import cdk = require('@aws-cdk/cdk');
-import perms = require('./perms');
 import { QueueRef } from './queue-ref';
 import { cloudformation } from './sqs.generated';
 import { validateProps } from './validate-props';
@@ -277,64 +275,6 @@ export class Queue extends QueueRef {
     }
   }
 
-  /**
-   * Grant permissions to consume messages from a queue
-   *
-   * This will grant the following permissions:
-   *
-   *   - sqs:ChangeMessageVisibility
-   *   - sqs:DeleteMessage
-   *   - sqs:ReceiveMessage
-   *
-   * @param identity Principal to grant consume rights to
-   */
-  public grantConsumeMessages(identity?: iam.IPrincipal) {
-    this.grant(identity, perms.QUEUE_GET_ACTIONS.concat(perms.QUEUE_CONSUME_ACTIONS));
-  }
-
-  /**
-   * Grant access to receive messages from a queue to
-   * the given identity.
-   *
-   * This will grant sqs:ReceiveMessage
-   *
-   * @param identity Principal to grant receive rights to
-   */
-  public grantReceiveMessages(identity?: iam.IPrincipal) {
-    this.grant(identity, perms.QUEUE_GET_ACTIONS);
-  }
-
-  /**
-   * Grant access to send messages to a queue to the
-   * given identity.
-   *
-   * This will grant sqs:SendMessage
-   *
-   * @param identity Principal to grant send rights to
-   */
-  public grantSendMessages(identity?: iam.IPrincipal) {
-    this.grant(identity, perms.QUEUE_PUT_ACTIONS);
-  }
-
-  /**
-   * Grant the actions defined in queueActions
-   * to the identity Principal given.
-   *
-   * @param identity Principal to grant right to
-   * @param queueActions The actions to grant
-   */
-  private grant(identity: iam.IPrincipal | undefined,
-                queueActions: string[]) {
-
-      if (!identity) {
-        return;
-      }
-
-      identity.addToPolicy(new iam.PolicyStatement()
-        .addResource(this.queueArn)
-        .addActions(...queueActions));
-  }
-
   /**
    * Look at the props, see if the FIFO props agree, and return the correct subset of props
    */