Users, Access Keys and Permissions
Every application connects as a user of your broker. Create one user per application, so you can limit and replace each one on its own.
Create a user
- In the control panel open SharkMQ, then your broker, then Users & keys.
- Enter a name (for example
orders-api) and the permissions, then click Add user. - Copy the details shown in the yellow box now. The secret is shown only once.
One user, two ways to log in
| Interface | Login | Password |
|---|---|---|
| AMQP | The AMQP user, for example c12-orders.orders-api | The secret |
| SQS / SNS (AWS SDKs) | The access key id, starting with SMQ | The same secret, as the secret access key |
Permissions
Each user has three patterns (regular expressions) that match queue and exchange names in your broker:
- configure: create and delete queues and exchanges.
- write: send messages.
- read: receive messages.
| Pattern | Means |
|---|---|
.* | everything |
^$ | nothing |
^orders$ | only the queue orders |
^orders-.* | every name starting with orders- |
A common setup: the sending app gets write on its queue only, the worker gets read on it only, and neither can create or delete queues.
Replace a secret
Click the rotate button next to the user. A new secret is shown once, and apps still using the old one are disconnected straight away. Deleting a user also disconnects its apps.
Keep secrets out of your source code: use environment variables or your platform's secret store.