I am currently working on integrating IBM QRadar with AWS SQS for log ingestion via S3 notifications. As part of the IAM policy configuration, I would like to confirm whether QRadar explicitly uses the DeleteMessage API to remove messages from the SQS queue after successful processing.

While the IBM Community blog titled "#BeyondTheDSMGuide: QRadar S3 Integration with an SQS Queue" mentions that messages are removed from the queue, I am looking for an official confirmation or documentation that clearly states the requirement for the sqs:DeleteMessage permission in the IAM role used by QRadar.

Could you please confirm:

1. Whether QRadar uses the DeleteMessage API when reading messages from AWS SQS.
2. If sqs:DeleteMessage is a mandatory permission for the IAM role used in this integration.

Hi Nitesh,

The permissions are listed in this portion of the QRadar docs regarding SQS queue permissions.

https://www.ibm.com/docs/en/uax?topic=notifications-creating-objectcreated

Section (7) mentions:

"Set a User or Role permission to access the SQS queue and for permission to download from the target bucket. The user or user role must have permission to read and delete from the SQS queue. For information about adding, managing and changing permissions for IAM users, see the IAM Users documentation. After QRadar reads the notification, and then downloads and processes the target file, the message must be deleted from the queue.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sqs:DeleteMessage",
                "sqs:ReceiveMessage",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>/AWSLogs/*",
                "arn:aws:sqs:us-east-2:<AWS_account_number>:<queue_name>"
            ]
        }
    ]
}