Amazon_SQS_9

Ensure SQS Dead-letter queue is not configured to send messages to the source queue

Description

A queues dead-letter queue should not be itself. If the dead-letter queue of a queue is itself, it wouldn’t be possible to distinguish between messages that were send to the source queue and the dead letter queue

Remediation

Perform the following to set a dead-letter queue for existing queue:

Via AWS Console
1. Login to AWS Console
2. Navigate to SQS Service
3. Create new queue. This queue will be used as the dead-letter queue of the existing queue.
4. Select the relevant existing queue and click Edit
5. Look for Dead-letter queue – Optional” in the drop down select the new queue ARN.

Via CLI:
aws sqs set-queue-attributes –queue-url <Queue url> –attributes <file:update_attributes.json>
Where the file should contain RedrivePolicy with deadLetterTargetArn different then the source queue.

Use the following reference for additional information regarding dead-letter queues:
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-dead-letter-queue.html
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html
CLI: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sqs/set-queue-attributes.html

Service

SQS

Severity

Low

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!