---
cuppy_hub: aws
cuppy_path: reference/sqs/queue-settings-and-encryption.md
cuppy_section: docs
cuppy_doc: MC7Q-TYGR
cuppy_doc_uuid: 8d850762-d48f-4c0e-b928-393e61443558
cuppy_permalink: https://cuppy.io/aws/d/MC7Q-TYGR
cuppy_version: 4
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/aws/docs/reference/sqs/queue-settings-and-encryption
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 1f60780e8d37a6df9a770bae1f45852f11d122afba3f708072f6fe3513bad60b
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# SQS queue settings, FIFO options and encryption

**If an AWS service (SNS, EventBridge, S3) writes into your queue, use SSE-SQS or a customer managed KMS key, never the AWS managed `aws/sqs` key.** The `aws/sqs` key's policy can't be edited to admit those services, and their messages silently fail to arrive.

## Attributes

| Attribute | Range (default) | Notes |
|---|---|---|
| `MessageRetentionPeriod` | 60 s – 14 days (4 days) | A DLQ needs **longer** retention than its source |
| `VisibilityTimeout` | 0 s – 12 h (30 s) | A Lambda trigger needs ≥ 6 × the function timeout (`patterns/sqs-to-lambda.md`) |
| `DelaySeconds` | 0 – 15 min (0) | Delays new messages |
| `ReceiveMessageWaitTimeSeconds` | 0 – 20 s (0 = short polling) | Set 20 for long polling by default |
| `RedrivePolicy` | JSON string: `deadLetterTargetArn`, `maxReceiveCount` (default 10) | The DLQ must be in the same account and Region |
| `RedriveAllowPolicy` (on the DLQ) | JSON string: `redrivePermission` `allowAll` (default) / `denyAll` / `byQueue` + `sourceQueueArns` (≤10) | Controls which queues may use this one as their DLQ |
| `ContentBasedDeduplication` (FIFO) | `true` / `false` | The deduplication ID is a SHA-256 of the body (attributes excluded) |
| `DeduplicationScope` (FIFO) | `messageGroup` / `queue` | High throughput: set `messageGroup`… |
| `FifoThroughputLimit` (FIFO) | `perQueue` / `perMessageGroupId` | …and `perMessageGroupId`, which is only allowed with `messageGroup` scope |
| `SqsManagedSseEnabled` | `true` / `false` | SSE-SQS (keys owned by SQS). Only one SSE option per queue |
| `KmsMasterKeyId` | key ID or alias (`alias/aws/sqs` for the AWS managed key) | SSE-KMS |
| `KmsDataKeyReusePeriodSeconds` | 60 – 86,400 (300) | Longer means fewer KMS calls; shorter means tighter key rotation |

Changes apply with `aws sqs set-queue-attributes --queue-url <url> --attributes '{…}'`. JSON-valued attributes (`RedrivePolicy`, `RedriveAllowPolicy`, `Policy`) are **strings containing JSON**.

## Encryption choices

| Option | Who can send | Cost and complexity |
|---|---|---|
| SSE-SQS (`SqsManagedSseEnabled: true`) | Anyone the queue policy and IAM allow; no KMS permissions involved | No KMS calls |
| SSE-KMS with `aws/sqs` | Your own principals with IAM KMS permissions. **Not** SNS, EventBridge or S3 | KMS calls |
| SSE-KMS with a **customer managed key** | Anyone allowed by the key policy and the queue policy, including AWS services | KMS calls; you manage the key policy |

### Key policy statement for service producers

Add one statement per producing service, with a confused-deputy condition:

```json
{
  "Effect": "Allow",
  "Principal": { "Service": "sns.amazonaws.com" },
  "Action": ["kms:Decrypt", "kms:GenerateDataKey"],
  "Resource": "*",
  "Condition": { "ArnEquals": { "aws:SourceArn": "arn:aws:sns:<region>:<account-id>:<topic>" } }
}
```

Use `events.amazonaws.com` with the rule ARN for EventBridge, and `s3.amazonaws.com` with the bucket ARN for S3. The SQS page names `aws:SourceArn` or `aws:SourceAccount`; the condition block above is the hub's composition. The SNS guide's own example (`patterns/sns-to-sqs-fanout.md`) grants `kms:GenerateDataKey*` without a condition.

### Principals in your account

- **Producers** need `kms:GenerateDataKey` and `kms:Decrypt` each time the data-key reuse period expires.
- **Consumers** need `kms:Decrypt`. DLQ consumers also need it on the **source** queue's key.
- KMS calls scale with the number of distinct principals: per period, (billing period ÷ reuse period) × (2 × producers + consumers).

KMS errors and key states: `reference/kms/key-policies-and-errors.md`. SQS-side names (`KmsAccessDenied`, `KmsDisabled`, …): `reference/sqs/errors.md`.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->