Capabilities
What the KubeMQ AWS (SQS & SNS) connector supports — the 18 SQS and 17 SNS actions, the queue and topic attributes, and the out-of-scope operations it rejects.
This reference defines exactly what the embedded KubeMQ AWS connector supports, what it accepts-and-ignores, and what it rejects. Use it to decide which AWS SDK calls are safe to rely on and which ones will be refused. Every action below is backed by the connector's SQS and SNS dispatch tables.
Supported SQS actions (18)
The SQS dispatch table ships exactly 18 actions:
| # | Action | Notes |
|---|---|---|
| 1 | CreateQueue | FIFO via .fifo suffix; same name + different attributes → QueueNameExists |
| 2 | DeleteQueue | removes the registry record, best-effort broker purge |
| 3 | GetQueueUrl | path-style URL; QueueOwnerAWSAccountId accepted and ignored |
| 4 | ListQueues | pagination + QueueNamePrefix; not authorization-filtered |
| 5 | PurgeQueue | 60 s cooldown → PurgeQueueInProgress |
| 6 | GetQueueAttributes | see the read-only attributes below |
| 7 | SetQueueAttributes | partial-update overlay; not retroactive |
| 8 | TagQueue | ≤ 50 tags |
| 9 | UntagQueue | |
| 10 | ListQueueTags | |
| 11 | ListDeadLetterSourceQueues | reverse-resolves RedrivePolicy sources |
| 12 | SendMessage | |
| 13 | SendMessageBatch | ≤ 10 entries; aggregate > 262,144 B → BatchRequestTooLong |
| 14 | ReceiveMessage | long poll, visibility, in-flight cap |
| 15 | DeleteMessage | idempotent (an unknown handle still succeeds) |
| 16 | DeleteMessageBatch | ≤ 10 entries |
| 17 | ChangeMessageVisibility | timeout > 0 moves the deadline; 0 NAcks (visible at tail) |
| 18 | ChangeMessageVisibilityBatch | ≤ 10 entries |
SQS queue attributes
Writable: DelaySeconds (0–900), MaximumMessageSize (1024–262144),
MessageRetentionPeriod (60–1209600), VisibilityTimeout (0–43200),
ReceiveMessageWaitTimeSeconds (0–20), RedrivePolicy; FIFO-only FifoQueue (create-only),
ContentBasedDeduplication, DeduplicationScope (queue | messageGroup).
Read-only on Get: QueueArn, ApproximateNumberOfMessages (broker stats, 2 s TTL),
ApproximateNumberOfMessagesNotVisible (node-local in-flight),
ApproximateNumberOfMessagesDelayed (always "0"), CreatedTimestamp,
LastModifiedTimestamp; FIFO adds FifoQueue / ContentBasedDeduplication / DeduplicationScope.
Supported SNS actions (17)
The SNS dispatch table ships exactly 17 actions:
| # | Action | Notes |
|---|---|---|
| 1 | CreateTopic | FIFO via .fifo suffix; idempotent on an existing name |
| 2 | DeleteTopic | cascades to subscriptions |
| 3 | ListTopics | ARN-sorted, 100/page; not authorization-filtered |
| 4 | GetTopicAttributes | |
| 5 | SetTopicAttributes | only DisplayName / DeliveryPolicy writable; Policy → InvalidParameter |
| 6 | Subscribe | protocols sqs / http / https only |
| 7 | ConfirmSubscription | the only GET action; SigV4-exempt |
| 8 | Unsubscribe | |
| 9 | GetSubscriptionAttributes | |
| 10 | SetSubscriptionAttributes | RawMessageDelivery, FilterPolicy, FilterPolicyScope (MessageAttributes only), RedrivePolicy, DeliveryPolicy |
| 11 | ListSubscriptions | not authorization-filtered |
| 12 | ListSubscriptionsByTopic | |
| 13 | Publish | rejects TargetArn / PhoneNumber |
| 14 | PublishBatch | |
| 15 | TagResource | topic OR subscription ARN; ≤ 50 tags |
| 16 | UntagResource | |
| 17 | ListTagsForResource |
SNS topic attributes
Writable: DisplayName, DeliveryPolicy. Surfaced on Get: TopicArn, Owner,
DisplayName, SubscriptionsConfirmed, SubscriptionsPending, SubscriptionsDeleted
(always 0), EffectiveDeliveryPolicy, optional DeliveryPolicy; FIFO adds FifoTopic=true +
ContentBasedDeduplication=false.
Topic-level ContentBasedDeduplication is not supported. Setting it → InvalidParameter;
getting it → always "false". Pass an explicit MessageDeduplicationId on each Publish to a
FIFO topic instead.
Out-of-scope operations
These are documented non-goals. They are never used as working examples, and most are actively rejected by the connector with the error code shown:
| Feature | Behavior |
|---|---|
FilterPolicyScope=MessageBody | rejected at the attribute setter → InvalidParameter ("MessageBody scope is not supported"); only MessageAttributes scope works |
KMS / SSE (KmsMasterKeyId, Policy, …) | InvalidAttributeName on a queue-attribute set |
AddPermission / RemovePermission (SQS + SNS) | InvalidAction |
SQS message-move tasks (StartMessageMoveTask / CancelMessageMoveTask / ListMessageMoveTasks) | InvalidAction |
SNS email / email-json / sms / lambda / application / firehose protocols + mobile-push / SMS / data-protection ops | InvalidParameter / InvalidAction |
Publish with TargetArn / PhoneNumber | InvalidParameter |
| Signed SNS notification verification | notifications are unsigned — Signature / SigningCertURL are present but empty; no SDK-side signature verification is possible |
| Extended client > 256 KiB | the aggregate body + attributes is capped at 262,144 bytes |
| CloudWatch metrics emulation | none emitted (Prometheus is the metrics surface — see Connections & Observability) |
| Cross-account semantics | QueueOwnerAWSAccountId accepted and ignored; a single configurable AccountId only |
Topic-level ContentBasedDeduplication | set → InvalidParameter, get → always "false" |
Inert / always-fixed values
These are accepted on the wire but carry no behavior (documented so you do not expect what is not there):
ApproximateNumberOfMessagesDelayedalways"0".SubscriptionsDeletedalways0.X-Amz-Security-Tokenaccepted and ignored.- The SigV4 credential-scope region is not enforced — any region signs successfully; the ARN
region segment defaults to
kubemq.
The eight gotchas
These behaviors deviate from real AWS and are easy to miss until a corner case hits production. Each is documented in depth where shown:
| # | Gotcha | Where documented |
|---|---|---|
| 1 | Receipt handles + in-flight are node-local → sticky LB required in clusters (SNS delivery state too) | SQS queues & consumers, Connectivity & security, Migrating from AWS |
| 2 | Region is not enforced — any region signs; the ARN segment defaults to kubemq | Authentication, Migrating from AWS |
| 3 | Dummy credentials still required in accept-any mode — the SDK must form a SigV4 request; an unsigned request is rejected (except ConfirmSubscription) | Getting Started, Authentication |
| 4 | MessageBody-scope filtering unsupported — only MessageAttributes scope works | SNS fan-out, this page |
| 5 | Empty-queue short-poll ~1 s latency floor; ApproximateNumberOfMessagesDelayed always "0" | SQS queues & consumers, this page |
| 6 | Unsigned SNS notifications — Signature / SigningCertURL present but empty | SNS fan-out, Fan-out, Migrating from AWS |
| 7 | Native-producer MessageId fallback — native producers on sqs.* get a broker-id MessageId, no SenderId, no policy stamping | Cross-protocol interop, Channel Mapping |
| 8 | SNS HTTP delivery state is in-memory on the publishing node — a restart loses pending retries; bounded job queue (10,000) overflow drops | Reliability, SNS topics, Migrating from AWS |
Two further documented deviations are surfaced in the reference docs but are not headline
gotchas: the FIFO SequenceNumber send-vs-receive difference and the raw-HTTP
attribute-drop. Both live in Channel Mapping.
Related
Channel Mapping
The sqs.{name} channel grammar, FIFO group encoding, and attribute/tag mapping.
Error Codes
The AWS SQS/SNS error codes behind each rejection above.
Connections & Observability
The management API and Prometheus metrics — there is no CloudWatch emulation.
Migrating from AWS
The deviations from real AWS and the endpoint-only switch.
Was this page helpful?
SQS queues and consumers
The AWS connector SQS surface end to end — queue lifecycle, send/receive/delete, visibility timeouts, long polling, batch operations, and DLQ/redrive.
Channel Mapping
How an AWS SQS queue maps to a KubeMQ Queue channel — the sqs.{name} grammar, FIFO message-group encoding, the virtual SNS registry, and the tag codec.