> For the complete documentation index, see [llms.txt](https://docs.digibee.com/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digibee.com/documentation/connectors-and-triggers/connectors/aws/sqs-aws.md).

# SQS (AWS)

Discover more about the SQS (AWS) connector and how to use it on the Digibee Integration Platform.

The **SQS (AWS)** connector enables users to send messages to standard AWS SQS queues and to FIFO AWS SQS queues.

## **Parameters**

The table below lists all configuration parameters for the connector. Parameters that support [Double Braces expressions](/documentation/connectors-and-triggers/double-braces/overview.md) are marked with ✅ in the **Supports DB** column.

{% tabs %}
{% tab title="General" %}

<table><thead><tr><th width="112.00006103515625">Parameter</th><th width="231.2000732421875">Description</th><th width="83.199951171875">Type</th><th width="80.7999267578125">Supports DB</th><th width="100">Default value</th><th width="124.7999267578125">Visible when</th></tr></thead><tbody><tr><td><strong>Alias</strong></td><td>A name for this connector's output, so you can reference it later in the flow with <a href="/documentation/connectors-and-triggers/double-braces/how-to-reference-data-using-double-braces.md#referencing-previous-steps-using-previous-steps-access">Double Braces</a>.</td><td>String</td><td>❌</td><td><code>aws-sqs-1</code></td><td>—</td></tr><tr><td><strong>Account Type</strong></td><td>The type of account used by the connector to authenticate. Options: <strong>Basic</strong> and <strong>AWS V4</strong>.</td><td>Select</td><td>❌</td><td><code>Basic</code></td><td>—</td></tr><tr><td><strong>Account</strong></td><td>The <a href="/documentation/developer-guide/development-cycle/build-overview/accounts.md#basic">Basic</a> account used to authenticate to the AWS Cloud service.</td><td>Select</td><td>❌</td><td>N/A</td><td><strong>Account Type</strong> is <strong>Basic</strong></td></tr><tr><td><strong>AWS V4 Account</strong></td><td>The <a href="/documentation/developer-guide/development-cycle/build-overview/accounts.md#aws-v4">AWS V4</a> account used to authenticate requests to AWS services with Signature Version 4.</td><td>Select</td><td>❌</td><td>N/A</td><td><strong>Account Type</strong> is <strong>AWS V4</strong></td></tr><tr><td><strong>Use Assume Role</strong></td><td>When enabled, the connector uses an <a href="/documentation/developer-guide/development-cycle/build-overview/accounts.md#aws-role">AWS Role</a> account to temporarily assume the permissions of the Account.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td><strong>Account Type</strong> is <strong>AWS V4</strong></td></tr><tr><td><strong>AWS Role Account</strong></td><td>The AWS Role account whose permissions are temporarily assumed by the Account through the Assume Role operation.</td><td>Select</td><td>❌</td><td>N/A</td><td><strong>Use Assume Role</strong> is enabled</td></tr><tr><td><strong>Message</strong></td><td>The body of the message to send.</td><td>String</td><td>❌</td><td><code>{{ message.$ }}</code></td><td>—</td></tr><tr><td><strong>Connection String</strong></td><td>The URL of the destination SQS queue in AWS.</td><td>String</td><td>✅</td><td><code>https://sqs.sa-east-1.amazonaws.com/838874755216/digibee-test</code></td><td>—</td></tr><tr><td><strong>Region</strong></td><td>The AWS region where the queue is registered.</td><td>String</td><td>❌</td><td><code>South America (Sao Paulo)</code></td><td>—</td></tr><tr><td><strong>Queue Type</strong></td><td>The type of queue that receives the message: <strong>Standard</strong> or <strong>FIFO</strong>. If <strong>FIFO</strong> is selected, the <strong>Message Group ID</strong> parameter becomes required.</td><td>String</td><td>❌</td><td><code>Standard</code></td><td>—</td></tr><tr><td><strong>Message Group ID</strong></td><td>For FIFO queues, the ID of the message group this message belongs to.</td><td>String</td><td>❌</td><td><code>undefined</code></td><td><strong>Queue Type</strong> is <strong>FIFO</strong></td></tr><tr><td><strong>Fail on Error</strong></td><td>If enabled, stops the pipeline execution when an error occurs. If disabled, execution continues, but the <code>"success"</code> property is set to <code>false</code>.</td><td>Boolean</td><td>❌</td><td><code>false</code></td><td>—</td></tr></tbody></table>

{% hint style="info" %}
Role ARN, Session Name, and External ID aren't configured on the connector. They're set when you create the **AWS Role** account that you select in the **AWS Role Account** parameter.
{% endhint %}
{% endtab %}

{% tab title="Documentation" %}

| Parameter         | Description                                                                             | Data type | Supports DB | Default value |
| ----------------- | --------------------------------------------------------------------------------------- | --------- | ----------- | ------------- |
| **Documentation** | Optional field to describe the connector configuration and any relevant business rules. | String    | ❌           | N/A           |
| {% endtab %}      |                                                                                         |           |             |               |
| {% endtabs %}     |                                                                                         |           |             |               |

## **Assume Role authentication**

The **SQS (AWS)** connector supports Assume Role, a cross-account access model that lets the connector use temporary, short-lived credentials instead of long-term static credentials.

### **When to use Assume Role**

Use Assume Role when the connector needs to access an SQS queue in a different AWS account than the one used for authentication, or when your security policy requires temporary credentials instead of long-lived access keys. Temporary credentials expire automatically, which reduces the risk of credential leakage.

### **Assume Role vs. Basic vs. AWS V4**

| Account type             | Credentials                                         | Typical use case                                                           |
| ------------------------ | --------------------------------------------------- | -------------------------------------------------------------------------- |
| **Basic**                | Static AWS access key and secret key                | Simple setups without cross-account requirements                           |
| **AWS V4**               | Static credentials, signed with Signature Version 4 | Direct access to AWS services in the same account                          |
| **AWS V4 + Assume Role** | Temporary credentials obtained through AWS STS      | Cross-account access, or environments that require short-lived credentials |

Assume Role isn't a standalone account type. It's an additional layer on top of an **AWS V4** account: the AWS V4 account authenticates first, then temporarily assumes the permissions of an **AWS Role** account.

### **Prerequisites**

Before enabling Assume Role on the connector, make sure:

* You have an **AWS V4** account configured in Digibee.
* You have an **AWS Role** account configured in Digibee, with the Role ARN, Session Name, and, optionally, External ID of the role you want to assume.
* The target role in AWS has a trust policy that allows Digibee's AWS V4 account to assume it. See IAM trust policy below.

{% hint style="info" %}
Only the **AWS V4** account type can use Assume Role. If **Account Type** is set to **Basic**, the **Use Assume Role** parameter isn't available.
{% endhint %}

### **Configuration example**

The example below shows a connector configured to use Assume Role.

* **Account Type**: AWS V4
* **Account**: my-aws-v4-account
* **Use Assume Role**: enabled
* **AWS Role Account**: my-aws-role-account
* **Region**: US East (North Virginia)
* **Connection String**: <https://sqs.us-east-1.amazonaws.com/123456789012/my-queue>

The AWS V4 account and the AWS Role account are referenced by the accounts configured in Digibee, not by their raw credentials or ARN.

### **IAM trust policy required on the AWS side**

To allow Digibee's execution role to assume the target role, configure the following trust policy on the role in your AWS account:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<ACCOUNT_ID_AWS>:role/digibee-execution-role"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
        }
      }
    }
  ]
}
```

Replace `<ACCOUNT_ID_AWS>` with your AWS account ID and `<YOUR_EXTERNAL_ID>` with the External ID configured in your AWS role, if you're using one.

### **IAM permissions required on the assumed role**

The role you assume must grant at least the following permissions for the connector to operate:

* `sqs:SendMessage`
* `sqs:ReceiveMessage`
* `sqs:DeleteMessage`
* `sqs:GetQueueAttributes`

### **Troubleshooting**

| Error                                                         | Likely cause                                                                                  | Resolution                                                                                                     |
| ------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| `AccessDenied` on `sts:AssumeRole`                            | The trust policy on the target role doesn't allow Digibee's execution role to assume it.      | Check the trust policy on the role in AWS and confirm the `Principal` and `Condition` values match your setup. |
| `InvalidClientTokenId`                                        | The AWS V4 account's credentials are invalid or expired.                                      | Check the credentials configured in the AWS V4 account.                                                        |
| `ExpiredToken`                                                | The temporary session token expired before the request completed.                             | Check the session duration configured for the assumed role in AWS.                                             |
| Assume Role fails even with correct ARN and account selection | The External ID configured in the AWS Role account doesn't match the one in the trust policy. | Confirm the External ID matches on both sides.                                                                 |

## **Messages flow**

{% hint style="info" %}
For details on how the Digibee Integration Platform processes message flow, see [Messages processing](/documentation/developer-guide/development-cycle/build-overview/pipelines/messages-processing.md).
{% endhint %}

### **Standard AWS SQS queue (without errors)**

#### **Payload**

```json
{
    "queueTest": "MyTestQueue"
}
```

#### **Input**

```json
{
    "url": "https://sqs.sa-east-1.amazonaws.com/381492217694/{{message.queueTest}}",
    "typeQueue": "STANDARD",
    "messageBody": "{\"test\": \"Test encryption\"}",
    "region": "sa-east-1",
    "failOnError": false
}
```

#### **Output**

```json
{
    "messageId": "c959b1da-6650-46c2-8baf-62302789dd61",
    "messageBodyMD5": "c35f05f412ea94ef45bf103ba96b7b0e",
    "sequenceNumber": null,
    "success": true,
    "requestId": "6c950c3a-d081-5685-893b-55cf8c1b51e0"
}
```

### **FIFO AWS SQS queue (without errors)**

#### **Input**

```json
{
    "url": "https://sqs.sa-east-1.amazonaws.com/123456789012/digibee-test.fifo",
    "typeQueue": "FIFO",
    "messageGroupId": "mygroup",
    "messageBody": "{\"test\": \"Test encryption\"}",
    "region": "sa-east-1",
    "failOnError": false
}
```

#### **Output**

```json
{
    "messageId": "c959b1da-6650-46c2-8baf-62302789dd61",
    "messageBodyMD5": "c35f05f412ea94ef45bf103ba96b7b0e",
    "sequenceNumber": "18865425420279279616",
    "success": true,
    "requestId": "6c950c3a-d081-5685-893b-55cf8c1b51e0"
}
```

### **FIFO AWS SQS queue (missing Message Group ID)**

#### **Input**

```json
{
    "url": "https://sqs.sa-east-1.amazonaws.com/123456789012/digibee-test.fifo",
    "typeQueue": "FIFO",
    "messageBody": "{\"test\": \"Test encryption\"}",
    "region": "sa-east-1",
    "failOnError": false
}
```

#### **Output**

```json
{
    "success": false,
    "message": "There is an invalid pipeline configuration",
    "error": "com.digibee.pipelineengine.exception.PipelineEngineConfigurationException: Configuration parameter 'messageGroupId' cannot be null for connector sqs-connector"
}
```

### **AWS SQS queue (invalid region)**

#### **Input**

```json
{
    "url": "https://sqs.sa-east-1.amazonaws.com/123456789012/digibee-test",
    "typeQueue": "STANDARD",
    "messageBody": "{\"test\": \"Test encryption\"}",
    "region": "wrong-region",
    "failOnError": false
}
```

#### **Output**

```json
{
    "success": false,
    "message": "Something went wrong while trying to execute SQS CONNECTOR",
    "error": "com.amazonaws.services.sqs.model.AmazonSQSException: Credential should be scoped to a valid region, not 'wrong-region'. (Service: AmazonSQS; Status Code: 403; Error Code: SignatureDoesNotMatch; Request ID: bf47d091-2129-5320-a332-89647ef0d86b)"
}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.digibee.com/documentation/connectors-and-triggers/connectors/aws/sqs-aws.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.