AWS SQS & SNS Support
SNS to SQS fan-out and subscription filter policies.
Publishing once to SNS and delivering to several SQS queues is a standard pattern, but it fails silently when the queue policy, the filter policy or encryption keys are wrong. We build the fan-out, debug missing deliveries, and add visibility so you know when a subscriber misses messages.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Messages published to SNS never reach an SQS queue
- A subscriber receives messages it should not, or none at all
- Consumers get a JSON envelope instead of the message body
- You need to send different event types to different services
- Delivery failures to subscribers go unnoticed
What you get
- Topic, queues, policies and filter policies in infrastructure as code
- A tested filter matrix of events and subscribers
- Subscription DLQs and delivery alarms
- A short debugging runbook
How we do it
A clear, safe process you can follow along with.
1. Confirm the subscription
We check that the SQS subscription is confirmed and in the same Region as the topic, or correctly cross-Region, and that the topic and queue types match for FIFO.
2. Fix the queue access policy
The queue needs a resource policy allowing sns.amazonaws.com to SendMessage, conditioned on the topic ARN as aws:SourceArn. A missing policy is the top reason for no delivery.
3. Check encryption keys
If the queue or topic uses a customer managed KMS key, the key policy must allow SNS to use it. The default AWS managed key for SQS cannot be used with SNS.
4. Write and test filter policies
Filter policies work on message attributes by default, or on the message body if the subscription's FilterPolicyScope is MessageBody. Attributes must be sent as typed attributes at publish time. A message that matches no policy is not delivered.
5. Decide on raw message delivery
By default SQS receives an SNS envelope with the message as a string. Raw message delivery passes the original body and attributes, which simplifies consumers, so we enable it and update the code to match.
6. Add delivery visibility
We attach a dead-letter queue to each subscription, enable delivery status logging for supported protocols, and alarm on NumberOfNotificationsFailed.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Forgetting the SourceArn condition
Without it the queue accepts messages from any topic, or none work. Be explicit.
Publishing attributes as part of the body
Attribute-scope filters cannot see them. Send real message attributes or switch to body scope.
Using the default SQS KMS key with SNS
SNS cannot use it. Use a customer managed key.
Not handling the envelope
A consumer expecting raw JSON breaks when it gets the SNS wrapper.
Frequently Asked Questions
Why is SNS not delivering to my SQS queue?
Most often the queue's access policy does not allow the topic, the subscription is unconfirmed, or a KMS key blocks SNS. Delivery failure metrics show which.
Can SNS filter on the message body?
Yes. Set the subscription's filter policy scope to MessageBody, and the policy then matches JSON fields in the body.
What does raw message delivery do?
It sends the original message to SQS or HTTP endpoints without the SNS JSON envelope, so consumers parse a simpler message.
Want Help With SNS to SQS fan-out and subscription filter policies?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required