# Capabilities (/connectors/aws/reference/capabilities)
This reference defines exactly what the embedded KubeMQ AWS connector **supports**, what it
**accepts-and-ignores**, and what it **rejects**. Use it to decide which AWS SDK calls are safe
to rely on and which ones will be refused. Every action below is backed by the connector's SQS
and SNS dispatch tables.
## Supported SQS actions (18) [#supported-sqs-actions-18]
The SQS dispatch table ships exactly **18** actions:
| # | Action | Notes |
| -- | ------------------------------ | ----------------------------------------------------------------------------- |
| 1 | `CreateQueue` | FIFO via `.fifo` suffix; same name + different attributes → `QueueNameExists` |
| 2 | `DeleteQueue` | removes the registry record, best-effort broker purge |
| 3 | `GetQueueUrl` | path-style URL; `QueueOwnerAWSAccountId` accepted and ignored |
| 4 | `ListQueues` | pagination + `QueueNamePrefix`; not authorization-filtered |
| 5 | `PurgeQueue` | 60 s cooldown → `PurgeQueueInProgress` |
| 6 | `GetQueueAttributes` | see the read-only attributes below |
| 7 | `SetQueueAttributes` | partial-update overlay; not retroactive |
| 8 | `TagQueue` | ≤ 50 tags |
| 9 | `UntagQueue` | |
| 10 | `ListQueueTags` | |
| 11 | `ListDeadLetterSourceQueues` | reverse-resolves `RedrivePolicy` sources |
| 12 | `SendMessage` | |
| 13 | `SendMessageBatch` | ≤ 10 entries; aggregate > 262,144 B → `BatchRequestTooLong` |
| 14 | `ReceiveMessage` | long poll, visibility, in-flight cap |
| 15 | `DeleteMessage` | idempotent (an unknown handle still succeeds) |
| 16 | `DeleteMessageBatch` | ≤ 10 entries |
| 17 | `ChangeMessageVisibility` | timeout > 0 moves the deadline; 0 NAcks (visible at tail) |
| 18 | `ChangeMessageVisibilityBatch` | ≤ 10 entries |
### SQS queue attributes [#sqs-queue-attributes]
**Writable:** `DelaySeconds` (0–900), `MaximumMessageSize` (1024–262144),
`MessageRetentionPeriod` (60–1209600), `VisibilityTimeout` (0–43200),
`ReceiveMessageWaitTimeSeconds` (0–20), `RedrivePolicy`; FIFO-only `FifoQueue` (create-only),
`ContentBasedDeduplication`, `DeduplicationScope` (`queue` | `messageGroup`).
**Read-only on Get:** `QueueArn`, `ApproximateNumberOfMessages` (broker stats, 2 s TTL),
`ApproximateNumberOfMessagesNotVisible` (node-local in-flight),
`ApproximateNumberOfMessagesDelayed` (**always `"0"`**), `CreatedTimestamp`,
`LastModifiedTimestamp`; FIFO adds `FifoQueue` / `ContentBasedDeduplication` / `DeduplicationScope`.
## Supported SNS actions (17) [#supported-sns-actions-17]
The SNS dispatch table ships exactly **17** actions:
| # | Action | Notes |
| -- | --------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| 1 | `CreateTopic` | FIFO via `.fifo` suffix; idempotent on an existing name |
| 2 | `DeleteTopic` | cascades to subscriptions |
| 3 | `ListTopics` | ARN-sorted, 100/page; not authorization-filtered |
| 4 | `GetTopicAttributes` | |
| 5 | `SetTopicAttributes` | only `DisplayName` / `DeliveryPolicy` writable; `Policy` → `InvalidParameter` |
| 6 | `Subscribe` | protocols `sqs` / `http` / `https` only |
| 7 | `ConfirmSubscription` | the only GET action; SigV4-exempt |
| 8 | `Unsubscribe` | |
| 9 | `GetSubscriptionAttributes` | |
| 10 | `SetSubscriptionAttributes` | `RawMessageDelivery`, `FilterPolicy`, `FilterPolicyScope` (MessageAttributes only), `RedrivePolicy`, `DeliveryPolicy` |
| 11 | `ListSubscriptions` | not authorization-filtered |
| 12 | `ListSubscriptionsByTopic` | |
| 13 | `Publish` | rejects `TargetArn` / `PhoneNumber` |
| 14 | `PublishBatch` | |
| 15 | `TagResource` | topic OR subscription ARN; ≤ 50 tags |
| 16 | `UntagResource` | |
| 17 | `ListTagsForResource` | |
### SNS topic attributes [#sns-topic-attributes]
**Writable:** `DisplayName`, `DeliveryPolicy`. **Surfaced on Get:** `TopicArn`, `Owner`,
`DisplayName`, `SubscriptionsConfirmed`, `SubscriptionsPending`, `SubscriptionsDeleted`
(always 0), `EffectiveDeliveryPolicy`, optional `DeliveryPolicy`; FIFO adds `FifoTopic=true` +
`ContentBasedDeduplication=false`.
**Topic-level `ContentBasedDeduplication` is not supported.** Setting it → `InvalidParameter`;
getting it → always `"false"`. Pass an explicit `MessageDeduplicationId` on each `Publish` to a
FIFO topic instead.
## Out-of-scope operations [#out-of-scope-operations]
These are documented non-goals. They are **never** used as working examples, and most are
actively rejected by the connector with the [error code](/connectors/aws/reference/error-codes)
shown:
| Feature | Behavior |
| ---------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **`FilterPolicyScope=MessageBody`** | rejected at the attribute setter → `InvalidParameter` ("MessageBody scope is not supported"); only `MessageAttributes` scope works |
| **KMS / SSE** (`KmsMasterKeyId`, `Policy`, …) | `InvalidAttributeName` on a queue-attribute set |
| **`AddPermission` / `RemovePermission`** (SQS + SNS) | `InvalidAction` |
| **SQS message-move tasks** (`StartMessageMoveTask` / `CancelMessageMoveTask` / `ListMessageMoveTasks`) | `InvalidAction` |
| **SNS `email` / `email-json` / `sms` / `lambda` / `application` / `firehose` protocols** + mobile-push / SMS / data-protection ops | `InvalidParameter` / `InvalidAction` |
| **`Publish` with `TargetArn` / `PhoneNumber`** | `InvalidParameter` |
| **Signed SNS notification verification** | notifications are **unsigned** — `Signature` / `SigningCertURL` are present but empty; no SDK-side signature verification is possible |
| **Extended client > 256 KiB** | the aggregate body + attributes is capped at 262,144 bytes |
| **CloudWatch metrics emulation** | none emitted (Prometheus is the metrics surface — see [Connections & Observability](/connectors/aws/reference/connections-endpoint)) |
| **Cross-account semantics** | `QueueOwnerAWSAccountId` accepted and ignored; a single configurable AccountId only |
| **Topic-level `ContentBasedDeduplication`** | set → `InvalidParameter`, get → always `"false"` |
## Inert / always-fixed values [#inert--always-fixed-values]
These are accepted on the wire but carry no behavior (documented so you do not expect what is
not there):
* `ApproximateNumberOfMessagesDelayed` always `"0"`.
* `SubscriptionsDeleted` always `0`.
* `X-Amz-Security-Token` accepted and ignored.
* The SigV4 credential-scope **region is not enforced** — any region signs successfully; the ARN
region segment defaults to `kubemq`.
## The eight gotchas [#the-eight-gotchas]
These behaviors deviate from real AWS and are easy to miss until a corner case hits production.
Each is documented in depth where shown:
| # | Gotcha | Where documented |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | **Receipt handles + in-flight are node-local → sticky LB required in clusters** (SNS delivery state too) | [SQS queues & consumers](/connectors/aws/how-to/sqs-queues-and-consumers), [Connectivity & security](/connectors/aws/how-to/connectivity-and-security), [Migrating from AWS](/connectors/aws/reference/migration-from-aws) |
| 2 | **Region is not enforced** — any region signs; the ARN segment defaults to `kubemq` | [Authentication](/connectors/aws/how-to/authentication), [Migrating from AWS](/connectors/aws/reference/migration-from-aws) |
| 3 | **Dummy credentials still required in accept-any mode** — the SDK must form a SigV4 request; an unsigned request is rejected (except `ConfirmSubscription`) | [Getting Started](/connectors/aws/tutorials/getting-started), [Authentication](/connectors/aws/how-to/authentication) |
| 4 | **`MessageBody`-scope filtering unsupported** — only `MessageAttributes` scope works | [SNS fan-out](/connectors/aws/how-to/sns-fan-out), this page |
| 5 | **Empty-queue short-poll \~1 s latency floor**; `ApproximateNumberOfMessagesDelayed` always `"0"` | [SQS queues & consumers](/connectors/aws/how-to/sqs-queues-and-consumers), this page |
| 6 | **Unsigned SNS notifications** — `Signature` / `SigningCertURL` present but empty | [SNS fan-out](/connectors/aws/how-to/sns-fan-out), [Fan-out](/connectors/aws/how-to/fan-out), [Migrating from AWS](/connectors/aws/reference/migration-from-aws) |
| 7 | **Native-producer MessageId fallback** — native producers on `sqs.*` get a broker-id MessageId, no SenderId, no policy stamping | [Cross-protocol interop](/connectors/aws/concepts/cross-protocol-interop), [Channel Mapping](/connectors/aws/reference/channel-mapping) |
| 8 | **SNS HTTP delivery state is in-memory on the publishing node** — a restart loses pending retries; bounded job queue (10,000) overflow drops | [Reliability](/connectors/aws/how-to/reliability), [SNS topics](/connectors/aws/how-to/sns-topics), [Migrating from AWS](/connectors/aws/reference/migration-from-aws) |
Two further documented deviations are surfaced in the reference docs but are not headline
gotchas: the FIFO **`SequenceNumber` send-vs-receive** difference and the **raw-HTTP
attribute-drop**. Both live in [Channel Mapping](/connectors/aws/reference/channel-mapping).
## Related [#related]