AWS SQS integration

Queue and authentication

Use an existing commercial-region SQS queue. The queue URL must match https://sqs.REGION.amazonaws.com/ACCOUNT/QUEUE. China/GovCloud, custom endpoints and role assumption are not implemented. Enter an access key/secret and optional temporary session token for an IAM principal restricted to this queue. Rotate temporary credentials before expiration.

FIFO queue URLs end in .fifo. MessageGroupId defaults to device ID or a configured fixed group. MessageDeduplicationId uses the stable delivery UUID. SQS deduplication is time-bounded and does not establish universal exactly-once processing. The worker sends one event per request; provider batch publication is not yet implemented. Queue ordering is not a guarantee of original device sequence ordering through retries.

Least privilege

SendMessage permits delivery. GetQueueAttributes is optional for read-only verification; send-only credentials can still deliver but the lookup may fail. Add specific KMS permissions separately if your encrypted queue requires them. Never supply administrator credentials.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:SendMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:us-east-1:123456789012:telemetry"
    }
  ]
}

Acceptance and errors

Struct requires a returned MessageId. Throttling, network failures and service outages use the shared retry policy. Invalid credentials, permissions, resource names and message configuration become visible failures. The JSON body contains the selected envelope; a struct_event_id message attribute also preserves identity. Receiving/consumer processing is outside this acknowledgment.