SQS queue settings, FIFO options and encryption
The SQS queue attributes that change behaviour — retention, visibility, delay, receive wait time, RedrivePolicy and RedriveAllowPolicy, FIFO content-based deduplication and high-throughput mode — and encryption with SSE-SQS or SSE-KMS, including the customer managed key policy SNS, EventBridge and S3 need to deliver into an encrypted queue, the producer and consumer KMS permissions, and the data-key reuse period.
markdownreferencev4MC7Q-TYGRstage: referencetrust: officialservice: sqsinterface: anySQS queue attributesMessageRetentionPeriodVisibilityTimeoutDelaySecondsReceiveMessageWaitTimeSecondsRedrivePolicyRedriveAllowPolicy byQueueContentBasedDeduplicationDeduplicationScopeFifoThroughputLimit perMessageGroupIdhigh throughput FIFOSSE-SQSSqsManagedSseEnabledSSE-KMS SQSKmsMasterKeyIdKmsDataKeyReusePeriodSecondsaws/sqs managed key SNSSQS key policy events.amazonaws.coms3.amazonaws.comsns.amazonaws.comSQS queue policy
If an AWS service (SNS, EventBridge, S3) writes into your queue, use SSE-SQS or a customer managed KMS key, never the AWS managed aws/sqs key. The aws/sqs key's policy can't be edited to admit those services, and their messages silently fail to arrive.
Attributes
| Attribute | Range (default) | Notes |
|---|---|---|
MessageRetentionPeriod | 60 s – 14 days (4 days) | A DLQ needs longer retention than its source |
VisibilityTimeout | 0 s – 12 h (30 s) | A Lambda trigger needs ≥ 6 × the function timeout (patterns/sqs-to-lambda.md) |
DelaySeconds | 0 – 15 min (0) | Delays new messages |
ReceiveMessageWaitTimeSeconds | 0 – 20 s (0 = short polling) | Set 20 for long polling by default |
RedrivePolicy | JSON string: deadLetterTargetArn, maxReceiveCount (default 10) | The DLQ must be in the same account and Region |
RedriveAllowPolicy (on the DLQ) | JSON string: redrivePermission allowAll (default) / denyAll / byQueue + sourceQueueArns (≤10) | Controls which queues may use this one as their DLQ |
ContentBasedDeduplication (FIFO) | true / false | The deduplication ID is a SHA-256 of the body (attributes excluded) |
DeduplicationScope (FIFO) | messageGroup / queue | High throughput: set messageGroup… |
FifoThroughputLimit (FIFO) | perQueue / perMessageGroupId | …and perMessageGroupId, which is only allowed with messageGroup scope |
SqsManagedSseEnabled | true / false | SSE-SQS (keys owned by SQS). Only one SSE option per queue |
KmsMasterKeyId | key ID or alias (alias/aws/sqs for the AWS managed key) | SSE-KMS |
KmsDataKeyReusePeriodSeconds | 60 – 86,400 (300) | Longer means fewer KMS calls; shorter means tighter key rotation |
Changes apply with aws sqs set-queue-attributes --queue-url <url> --attributes '{…}'. JSON-valued attributes (RedrivePolicy, RedriveAllowPolicy, Policy) are strings containing JSON.
Encryption choices
| Option | Who can send | Cost and complexity |
|---|---|---|
SSE-SQS (SqsManagedSseEnabled: true) | Anyone the queue policy and IAM allow; no KMS permissions involved | No KMS calls |
SSE-KMS with aws/sqs | Your own principals with IAM KMS permissions. Not SNS, EventBridge or S3 | KMS calls |
| SSE-KMS with a customer managed key | Anyone allowed by the key policy and the queue policy, including AWS services | KMS calls; you manage the key policy |
Key policy statement for service producers
Add one statement per producing service, with a confused-deputy condition:
{
"Effect": "Allow",
"Principal": { "Service": "sns.amazonaws.com" },
"Action": ["kms:Decrypt", "kms:GenerateDataKey"],
"Resource": "*",
"Condition": { "ArnEquals": { "aws:SourceArn": "arn:aws:sns:<region>:<account-id>:<topic>" } }
}Use events.amazonaws.com with the rule ARN for EventBridge, and s3.amazonaws.com with the bucket ARN for S3. The SQS page names aws:SourceArn or aws:SourceAccount; the condition block above is the hub's composition. The SNS guide's own example (patterns/sns-to-sqs-fanout.md) grants kms:GenerateDataKey* without a condition.
Principals in your account
- Producers need
kms:GenerateDataKeyandkms:Decrypteach time the data-key reuse period expires. - Consumers need
kms:Decrypt. DLQ consumers also need it on the source queue's key. - KMS calls scale with the number of distinct principals: per period, (billing period ÷ reuse period) × (2 × producers + consumers).
KMS errors and key states: reference/kms/key-policies-and-errors.md. SQS-side names (KmsAccessDenied, KmsDisabled, …): reference/sqs/errors.md.