Configuration
Reference table of the ten CONNECTORS_AWS_* environment variables for the KubeMQ AWS connector, with TOML, Env, and Docker equivalents.
Field-by-field reference for the KubeMQ AWS connector's Connectors.Aws config block. See
Configuration concepts for why the connector is opt-in and how
the two credential postures work.
Configuration fields
All values below are verified against the connector source (AwsConfig struct and
defaultAwsConfig). Compound camelCase fields are snake-split in their env form — e.g.
MaxInflightPerQueue → CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE, AccountId →
CONNECTORS_AWS_ACCOUNT_ID.
| Env var | Default | Type | Meaning / validation |
|---|---|---|---|
CONNECTORS_AWS_ENABLE | false | bool | Opt-in. true opens the listener on Port; false skips the connector entirely. |
CONNECTORS_AWS_PORT | "4566" | string | The listener port (the LocalStack convention). Must differ from any enabled Grpc/Rest/Http port. A single TCP listener; POST / and GET / both dispatch. |
CONNECTORS_AWS_REGION | "kubemq" | string | The ARN region segment; informational only. NOT enforced in SigV4 — any region in the credential scope signs successfully. |
CONNECTORS_AWS_ACCOUNT_ID | "000000000000" | string | A single configurable 12-digit value (validated). There is no cross-account support; QueueOwnerAWSAccountId is accepted and ignored. |
CONNECTORS_AWS_ADVERTISED_URL | "" | string | Overrides the host in returned queue URLs; must be scheme://host[:port]. When empty, the request Host is used. Resolution parses the path only, so stale hosts in saved URLs still work. |
CONNECTORS_AWS_CREDENTIALS_DATA | "" | string | A JSON (optionally base64-encoded) array of static SigV4 credentials — the env/operator path for a secured connector. When set, SigV4 is fully verified. |
CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE | 20000 | int | Per-queue / per-node cap on received-but-not-deleted (in-flight) messages; exceeding it returns OverLimit. |
CONNECTORS_AWS_MAX_CONCURRENT_POLLS | 1024 | int | The parked long-poll slot pool. When exhausted, a ReceiveMessage degrades to a short poll rather than erroring. |
CONNECTORS_AWS_READ_TIMEOUT | 60 | int | Per-action context deadline in seconds for synchronous ops. ReceiveMessage is exempt and gets at least a ~25 s budget. |
CONNECTORS_AWS_BODY_LIMIT | "2M" | string | Request body size cap. |
The AwsConfig struct has 11 fields, of which 10 are env-bound. The 11th, the structured
Credentials array, has no env binding — it is file/structured-config only.
CONNECTORS_AWS_CREDENTIALS_DATA is the env path for static credentials, and merges with any
file-only Credentials (Data wins on duplicates).
Configuring the connector
The same settings can be supplied through a TOML config file, environment variables, or
docker run flags. Every environment variable uses the CONNECTORS_AWS_ prefix (with the
underscore between CONNECTORS and AWS).
[Connectors.Aws]
Enable = true
Port = "4566"
Region = "kubemq"
AccountId = "000000000000"
AdvertisedUrl = ""
CredentialsData = ""
MaxInflightPerQueue = 20000
MaxConcurrentPolls = 1024
ReadTimeout = 60
BodyLimit = "2M"CONNECTORS_AWS_ENABLE=true
CONNECTORS_AWS_PORT=4566
CONNECTORS_AWS_REGION=kubemq
CONNECTORS_AWS_ACCOUNT_ID=000000000000
CONNECTORS_AWS_ADVERTISED_URL=
CONNECTORS_AWS_CREDENTIALS_DATA=
CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE=20000
CONNECTORS_AWS_MAX_CONCURRENT_POLLS=1024
CONNECTORS_AWS_READ_TIMEOUT=60
CONNECTORS_AWS_BODY_LIMIT=2Mdocker run -d \ --pull always \ --platform linux/amd64 \ --name kubemq \ --hostname kubemq \ -p 127.0.0.1:4566:4566 \ -p 127.0.0.1:50000:50000 \ -e STORE_ENGINE=next \ -e STORE_NEXT_ACK_POLICY=strict \ -e STORE_STORE_PATH=/kubemq/store \ -e API_BIND_ADDRESS=0.0.0.0 \ -e CONNECTORS_AWS_ENABLE=true \ -e CONNECTORS_AWS_ADVERTISED_URL=http://kubemq.example.com:4566 \ -e CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE=50000 \ -v kubemq-data:/kubemq/store \ europe-docker.pkg.dev/kubemq/images/kubemq-next:latestBecause the connector is opt-in (as are five of the seven wire-protocol connectors — only
Kafka and RabbitMQ / AMQP 0-9-1 are on by default), the Docker example
must include -e CONNECTORS_AWS_ENABLE=true — without it, no AWS listener binds. Set
=false to turn it off again.
Related
Getting Started
Enable the connector and run an SQS round-trip end-to-end in minutes.
Architecture
One binary, two service surfaces — SQS as a Queue channel and the virtual SNS registry.
Authentication
SigV4 accept-any vs static credentials, the ConfirmSubscription exemption, and per-channel authorization.
Capabilities
Supported SQS/SNS actions, the limitations list, and the out-of-scope features.
Was this page helpful?
Channel Mapping
How an AWS SQS queue maps to a KubeMQ Queue channel — the sqs.{name} grammar, FIFO message-group encoding, the virtual SNS registry, and the tag codec.
Connections & Observability
The AWS connector's observability surface — the read-only management API, the Prometheus metrics, the dashboard page, and the audit events it emits.