Role definition for multiple SQS queues is duplicated

[ROSeaboyer]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest v3 release?

• Yes, I'm using the latest v3 release

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

If I have two lambda functions, each consuming from a separate SQS queue, the resulting IAM role has the SQS section defined as so:
{ "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Resource": [ "arn:aws:sqs:ca-central-1:864919514680:test-queue-1" ] }, { "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Resource": [ { "Fn::GetAtt": [ "TestQueue2", "Arn" ] } ] }

Instead, it should be defined as this:
{ "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes" ], "Resource": [ "arn:aws:sqs:ca-central-1:864919514680:test-queue-1", { "Fn::GetAtt": [ "TestQueue2", "Arn" ] } ] }

I've found that the first option makes the role hit the 10,644 character limit too quickly for no apparent reason, while the second still seems fine for the time being.

The change I've patched to prevent this just moves the PolicyDocument update for SQS in lib/plugins/aws/package/compile/events/sqs.js outside the loop of all functions; I'm fine pushing that up, but let me know if there's a more desired approach for this.

Service configuration (serverless.yml) content

service: ROSeaboyer-test
provider:
  name: aws
  region: ca-central-1
  runtime: python3.9
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - xray:PutTraceSegments
          Resource: '*'
functions:
  testOne:
    name: test-lambda
    handler: test.handler
    package:
      patterns:
        - '*/test.py'
    events:
      - sqs:
          arn: arn:aws:sqs:ca-central-1:<account-id>:test-queue-1

  testTwo:
    name: test-lambda-two
    handler: test.handler
    package:
      patterns:
        - '*/test.py'
    events:
      - sqs:
          arn: !GetAtt TestQueue2.Arn

resources:
  Resources:
    TestQueue2:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: test-queue-2

Command name and used flags

serverless package

Command output

N/A

Environment information

Framework Core: 3.26.0 (local)
Plugin: 6.2.2
SDK: 4.3.2

[medikoo]

@ROSeaboyer I wouldn't call it a bug, as it doesn't break anything.

Nonetheless, an improvement to that is definitely welcome. We're open for PR!

[ROSeaboyer]

@medikoo Makes sense, as I was unsure which direction to report this as. PR #11685 created to address this