# Configuration (/connectors/aws/reference/configuration)



Field-by-field reference for the KubeMQ AWS connector's `Connectors.Aws` config block. See
[Configuration concepts](../concepts/configuration) for why the connector is opt-in and how
the two credential postures work.

## Configuration fields [#configuration-fields]

All values below are verified against the connector source (`AwsConfig` struct and
`defaultAwsConfig`). Compound camelCase fields are snake-split in their env form — e.g.
`MaxInflightPerQueue` → `CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE`, `AccountId` →
`CONNECTORS_AWS_ACCOUNT_ID`.

| Env var                                 | Default          | Type   | Meaning / validation                                                                                                                                                                             |
| --------------------------------------- | ---------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `CONNECTORS_AWS_ENABLE`                 | `false`          | bool   | Opt-in. `true` opens the listener on `Port`; `false` skips the connector entirely.                                                                                                               |
| `CONNECTORS_AWS_PORT`                   | `"4566"`         | string | The listener port (the LocalStack convention). Must differ from any enabled Grpc/Rest/Http port. A single TCP listener; `POST /` and `GET /` both dispatch.                                      |
| `CONNECTORS_AWS_REGION`                 | `"kubemq"`       | string | The ARN region segment; informational only. **NOT enforced** in SigV4 — any region in the credential scope signs successfully.                                                                   |
| `CONNECTORS_AWS_ACCOUNT_ID`             | `"000000000000"` | string | A single configurable 12-digit value (validated). There is **no cross-account support**; `QueueOwnerAWSAccountId` is accepted and ignored.                                                       |
| `CONNECTORS_AWS_ADVERTISED_URL`         | `""`             | string | Overrides the host in returned queue URLs; must be `scheme://host[:port]`. When empty, the request `Host` is used. Resolution parses the **path only**, so stale hosts in saved URLs still work. |
| `CONNECTORS_AWS_CREDENTIALS_DATA`       | `""`             | string | A JSON (optionally base64-encoded) array of static SigV4 credentials — the env/operator path for a secured connector. When set, SigV4 is fully verified.                                         |
| `CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE` | `20000`          | int    | Per-queue / per-node cap on received-but-not-deleted (in-flight) messages; exceeding it returns `OverLimit`.                                                                                     |
| `CONNECTORS_AWS_MAX_CONCURRENT_POLLS`   | `1024`           | int    | The parked long-poll slot pool. When exhausted, a `ReceiveMessage` **degrades to a short poll** rather than erroring.                                                                            |
| `CONNECTORS_AWS_READ_TIMEOUT`           | `60`             | int    | Per-action context deadline in seconds for synchronous ops. `ReceiveMessage` is exempt and gets at least a \~25 s budget.                                                                        |
| `CONNECTORS_AWS_BODY_LIMIT`             | `"2M"`           | string | Request body size cap.                                                                                                                                                                           |

<Callout type="info">
  The `AwsConfig` struct has &#x2A;*11 fields, of which 10 are env-bound.** The 11th, the structured
  `Credentials` array, has **no env binding** — it is file/structured-config only.
  `CONNECTORS_AWS_CREDENTIALS_DATA` is the env path for static credentials, and merges with any
  file-only `Credentials` (Data wins on duplicates).
</Callout>

## Configuring the connector [#configuring-the-connector]

The same settings can be supplied through a TOML config file, environment variables, or
`docker run` flags. Every environment variable uses the `CONNECTORS_AWS_` prefix (with the
underscore between `CONNECTORS` and `AWS`).

<Tabs groupId="config-source" items="['TOML', 'Environment', 'Docker']">
  <Tab value="TOML">
    ```toml title="config.toml"
    [Connectors.Aws]
      Enable = true
      Port = "4566"
      Region = "kubemq"
      AccountId = "000000000000"
      AdvertisedUrl = ""
      CredentialsData = ""
      MaxInflightPerQueue = 20000
      MaxConcurrentPolls = 1024
      ReadTimeout = 60
      BodyLimit = "2M"
    ```
  </Tab>

  <Tab value="Environment">
    ```bash title="aws.env"
    CONNECTORS_AWS_ENABLE=true
    CONNECTORS_AWS_PORT=4566
    CONNECTORS_AWS_REGION=kubemq
    CONNECTORS_AWS_ACCOUNT_ID=000000000000
    CONNECTORS_AWS_ADVERTISED_URL=
    CONNECTORS_AWS_CREDENTIALS_DATA=
    CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE=20000
    CONNECTORS_AWS_MAX_CONCURRENT_POLLS=1024
    CONNECTORS_AWS_READ_TIMEOUT=60
    CONNECTORS_AWS_BODY_LIMIT=2M
    ```
  </Tab>

  <Tab value="Docker">
    <RunKubeMQ
      ports="[4566, 50000]"
      env="{
      CONNECTORS_AWS_ENABLE: 'true',
      CONNECTORS_AWS_ADVERTISED_URL: 'http://kubemq.example.com:4566',
      CONNECTORS_AWS_MAX_INFLIGHT_PER_QUEUE: '50000',
    }"
    />
  </Tab>
</Tabs>

<Callout type="info">
  Because the connector is opt-in (as are all six wire-protocol connectors), the Docker example
  **must** include `-e CONNECTORS_AWS_ENABLE=true` — without it, no AWS listener binds. Set
  `=false` to turn it off again.
</Callout>

## Related [#related]

<Cards>
  <Card title="Getting Started" href="/connectors/aws/tutorials/getting-started" description="Enable the connector and run an SQS round-trip end-to-end in minutes." />

  <Card title="Architecture" href="/connectors/aws/concepts/architecture" description="One binary, two service surfaces — SQS as a Queue channel and the virtual SNS registry." />

  <Card title="Authentication" href="/connectors/aws/how-to/authentication" description="SigV4 accept-any vs static credentials, the ConfirmSubscription exemption, and per-channel authorization." />

  <Card title="Capabilities" href="/connectors/aws/reference/capabilities" description="Supported SQS/SNS actions, the limitations list, and the out-of-scope features." />
</Cards>