Verify the SQS resource policy does not deny the role and that the role allows queue access

After IAM changes, the two likely causes are an explicit Deny in the SQS resource policy (B) or the role no longer having an Allow for queue access (E). Verifying both keeps least privilege—you do not add broad managed policies. MFA on the role (A) is unrelated to SQS retrieval; access keys (C) are not how EC2 instance roles authenticate; attaching SQSFullAccess (D) violates least privilege. B and E are correct.

EC2 instances stopped retrieving SQS messages after IAM changes. While keeping least privilege, troubleshoot by confirming the SQS queue resource policy does not contain an explicit Deny for the instance role, and confirming the role attached to the instances actually includes policies that allow the needed SQS actions. These two checks isolate whether the break is a resource-policy deny or a missing identity-policy grant.

Attaching AmazonSQSFullAccess (D)—that fixes access but violates the least-privilege requirement. Checking the role's access key (C)—instance roles use temporary credentials, not static access keys. Adding MFA to the role (A)—unrelated to why SQS reads fail. The right move is to verify the resource policy deny and the role's allow (B, E).