No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

``` console.log('  - creating global IAM Role for data feed Lambda functions')

  const lambdaRole = new aws.iam.Role('iamr-data-feed-lambda', {
    assumeRolePolicy: `{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": "sts:AssumeRole",
          "Principal": {
            "Service": "<http://lambda.amazonaws.com|lambda.amazonaws.com>"
          },
          "Effect": "Allow"
        }
      ]
    }`
  })

  console.log('  - attaching AWSLambda_FullAccess managed policy to Lambda role')

  // eslint-disable-next-line no-new
  new aws.iam.RolePolicyAttachment('iamrpa-data-feed-lambda-role-lambda-access-policy', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/AWSLambda_FullAccess'
  })

  console.log('  - attaching AWSLambdaVPCAccessExecutionRole managed policy to Lambda role')

  // eslint-disable-next-line no-new
  new aws.iam.RolePolicyAttachment('iamrpa-data-feed-lambda-role-vpc-access-policy', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole'
  })

  console.log('  - attaching AWSLambdaSQSQueueExecutionRole managed policy to Lambda role')

  // eslint-disable-next-line no-new
  new aws.iam.RolePolicyAttachment('iamrpa-data-feed-lambda-role-sqs-queue-policy', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole'
  })```

&gt; *AWSLambdaSQSQueueExecutionRole* – Permission to read a message from an Amazon Simple Queue Service (Amazon SQS) queue.

You are sending a message thus you are *writing*

Also if you are consuming SQS then you'll need write permissions

Just reading doesn't need it but that would be pretty pointless with SQS, you'll want to also update it and thus write permissions are required

Your issue is not Pulumi specific but AWS specific and AWS IAM specific to be more exact

is there a AWS managed policy I can use to write?

``` const sqsLambdaRole = new aws.iam.Policy('policy', {
    path: '/',
    description: 'SQSLambdaRole',
    policy: JSON.stringify({
      Version: '2012-10-17',
      Statement: [
        {
          Effect: 'Allow',
          Action: [
            'sqs:DeleteMessage',
            'logs:CreateLogStream',
            'sqs:ReceiveMessage',
            'sqs:SendMessage',
            'sqs:SendMessageBatch',
            'sqs:GetQueueAttributes',
            'logs:CreateLogGroup',
            'logs:PutLogEvents'
          ],
          Resource: '*'
        }
      ]
    })
  })```

I suggest you try `'sqs:*'` and see if it works after that. AWS IAM permissions are pain in the ass in general.