IAM policy sample missing required Actions in documentation

[rrix]

• Version: current
• Operating System:n/a

The documentation for both the sqs input and output plugins provide a sample IAM policy document which is missing Action keys listed directly above it in the docs:

The "consumer" identity must have the following permissions on the queue:
sqs:ChangeMessageVisibility
sqs:ChangeMessageVisibilityBatch
sqs:DeleteMessage
sqs:DeleteMessageBatch
sqs:GetQueueAttributes
sqs:GetQueueUrl
sqs:ListQueues
sqs:ReceiveMessage

yet the sample policy is missing DeleteMessage and DeleteMessageBatch:

{
  "Statement": [
    {
      "Action": [
        "sqs:ChangeMessageVisibility",
        "sqs:ChangeMessageVisibilityBatch",
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:ListQueues",
        "sqs:SendMessage",
        "sqs:SendMessageBatch"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:sqs:us-east-1:123456789012:Logstash"
      ]
    }
  ]
}

There is a similar issue in the output plugin which I will open seperately, and imo an issue with the error handling of AccessDenied errors, since logstash doesnt log which action is attempting to be done, and Cloudtrail doesnt log SQS API calls.

Feb 02 18:27:11 ip-10-202-5-90 logstash[410]: {:timestamp=>"2017-02-02T18:27:11.273000+0000", :message=>"Aws::SQS::Errors::ServiceError ... retrying SQS request with exponential backoff", :queue=>"logstash_logs_us-west-1_staging_logstash-test-emitter", :sleep_time=>1, :error=>#<Aws::SQS::Errors::AccessDenied: Access to the resource https://sqs.us-west-1.amazonaws.com/[REDACTED]/logstash_logs_us-west-1_staging_logstash-test-emitter is denied.>, :level=>:warn}

[rrix]

Hrm, I was mistaken about the output plugin, the documentation matches there. However, I still think the error handling in bad IAM case could use improvement judging by logstash-plugins/logstash-output-sqs#17