The Complete Production SOP: How to Deploy and Run AWS SNS to SQS Fan-Out Messaging & Dead-Letter Queues in Autonomous AI Agents
Step-by-step SOP to install and run the AWS SNS-SQS Fan-Out pattern in Codex, Claude Code, and Cursor. Master filter policies, DLQs, and IaC verification.
Technical Overview & Architectural Context
Autonomous coding agents frequently stumble when provisioning event-driven AWS architectures like the SNS-to-SQS fan-out pattern. Common failure modes include omitting the SQS queue resource policy that grants SNS 'sqs:SendMessage' permissions, misconfiguring subscription raw message delivery, and defining circular or non-existent Dead-Letter Queue (DLQ) redrive policies. Without strict constraints, agents hallucinate IAM roles instead of SQS resource policies or create subscription filter policies with invalid JSON schema structures. The 'aws-sqs-sns-fanout-pattern' skill establishes deterministic SOP boundaries for Codex, Claude Code, Cursor, and Windsurf. It enforces exact ordering: defining SNS topics and target SQS queues first, provisioning dedicated DLQ redrive policies, injecting the essential 'aws:SourceArn' condition into the SQS access policy, and establishing strict attribute-based SNS subscription filters with RawMessageDelivery flags. This prevents silent delivery failures, message drops, and non-convergent IaC rollbacks.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into agent runtimes.
To enable Claude Code, Codex, Cursor, or Windsurf to discover the skill, place the canonical SKILL.md file in the workspace or global agent skills path. Claude Code inspects '.claude/skills/' or project root configurations, while Cursor and Windsurf ingest skills via '.cursor/rules/' or workspace SKILL.md manifests. Mounting the skill injects triggering policies and IaC quality controls into the agent's context.
mkdir -p .cursor/rules ~/.agents/skills/aws-sqs-sns-fanout-pattern && curl -fsSL https://askills.dev/api/skills/aws-sqs-sns-fanout-pattern/raw -o ~/.agents/skills/aws-sqs-sns-fanout-pattern/SKILL.md && cp ~/.agents/skills/aws-sqs-sns-fanout-pattern/SKILL.md .cursor/rules/aws-sqs-sns-fanout.mdc---
name: "aws-sqs-sns-fanout-pattern"
description: "Broadcast asynchronous events to multiple decoupled processing queues using SNS and SQS."
metadata:
author: "AWS"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "implement sns sqs fanout"
- "configure sqs dead letter queue"
- "sns message filter policy"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# AWS SNS to SQS Fan-Out Messaging & Dead-Letter Queues
Implements the SNS-SQS Fan-Out pattern: subscribing multiple SQS queues to an SNS topic, message filtering policies (attribute-based), dead-letter queue (DLQ) redrive, and KMS envelope encryption.
## Execution SOP & Rules
1. Create SNS topic and target SQS queues; declare primary and DLQ pairs before wiring subscriptions.
2. Apply SQS Queue Policy granting sns.amazonaws.com 'sqs:SendMessage' restricted to topic ARN.
3. Create SNS subscriptions with Queue ARN, RawMessageDelivery: true, and explicit FilterPolicy.
4. Set redrivePolicy on target SQS pointing to verified DLQ ARN with maxReceiveCount between 3 and 5.Keep the SKILL.md body concise. Restricting the rules to exact IaC constraints saves up to 1,200 prompt tokens per inference cycle in Claude Code and Cursor.
Do not grant 'shell_exec: true' or 'net_access: true' in frontmatter unless required for dry-runs. The skill only requires workspace write permissions to emit IaC definitions.
Environment Secrets & Dependency Validation
Ensure AWS credential environments and linter dependencies are cleanly partitioned without credential leakage.
Autonomous agents should never read raw AWS secret keys directly in LLM conversation context. Inject AWS environment variables via standard process environment or local AWS profiles. Ensure Terraform or CDK CLI tools are present so the agent can execute static validation without invoking active cloud mutations.
aws sts get-caller-identity > /dev/null 2>&1 || (echo 'AWS credentials missing or expired' && exit 1)Never put AWS_SECRET_ACCESS_KEY inside prompt instructions or git-tracked files; use AWS_PROFILE or short-lived federated STS session tokens.
Ensure '.env*' and terraform state files (*.tfstate) are included in '.gitignore' to prevent accidental exposure during agent workspace commits.
Intent Matching & Trigger Invocation
Activate the skill deterministically using prompt directives that trigger frontmatter hooks.
Agent runtimes scan conversation prompts against registered skill triggers. Using precise phrasing such as 'implement sns sqs fanout' or 'sns message filter policy' forces the agent to bypass generalized multi-cloud answers and strictly execute the fan-out SOP with SQS resource policies, DLQ redrive, and message filtering.
Prefix prompts with explicit target constraints: 'Using aws-sqs-sns-fanout-pattern, implement sns sqs fanout for international order events with DLQ in Terraform.'
Avoid ambiguous prompts like 'decouple my services with queues', which may lead the agent to hallucinate RabbitMQ or generic EventBridge code.
Verification, Linting & Output Quality Gate
Run structural validation and IAM/policy linter tests before committing generated architecture code.
Instruct the agent to validate the generated IaC manifests. For Terraform, execute 'terraform fmt -check' and 'terraform validate'. For AWS CDK, run 'cdk synth'. Verify that the generated SQS policy contains the 'aws:SourceArn' condition to prevent the confused deputy vulnerability.
terraform validate && tflintReview the generated queue policy diff to verify that 'sqs:SendMessage' is constrained strictly by 'Condition: { ArnEquals: { aws:SourceArn: <topic_arn> } }'.
If 'RawMessageDelivery' is set to false, JSON message attributes used for SNS subscription filter policies will not be passed natively to SQS payloads in microservice consumer code.
Real-World Scenario: E-Commerce Checkout Order Fan-Out with International DLQ and Message Filtering
“Implement sns sqs fanout for an order processing system. Broadcast 'OrderCreated' events to two queues: 'domestic-fulfillment-queue' and 'international-fulfillment-queue'. International orders (order_type = 'international') should route only to the international queue. Both queues must have dead-letter queues configured with maxReceiveCount of 3, RawMessageDelivery enabled, and secure queue policies restricting sender to the SNS topic ARN.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent emitted the SNS subscription filter policy as a plain key-value map or malformed string instead of AWS-compliant string array structures (e.g. {"key": ["value"]}).
Ensure filter policies match AWS JSON array standards: jsonencode({"order_type": ["international"]}) instead of {"order_type": "international"}.Root Cause: The target SQS queue is missing the required queue resource policy granting sns.amazonaws.com permission to call sqs:SendMessage, or the condition specifies an incorrect topic ARN.
aws sqs set-queue-attributes --queue-url <QUEUE_URL> --attributes '{"Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"sns.amazonaws.com\"},\"Action\":\"sqs:SendMessage\",\"Resource\":\"<QUEUE_ARN>\",\"Condition\":{\"ArnEquals\":{\"aws:SourceArn\":\"<TOPIC_ARN>\"}}}]}"}'Frequently Asked Questions (AWS SNS to SQS Fan-Out Messaging & Dead-Letter Queues SOP)
Q:Can I use AWS SNS to SQS Fan-Out Messaging & Dead-Letter Queues across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. Claude Code accesses it via '.claude/skills/' or project configs, Cursor reads it via '.cursor/rules/', and Codex/Windsurf consume it from the workspace root or global agent directory.
Q:How does AWS SNS to SQS Fan-Out Messaging & Dead-Letter Queues prevent context window overflow during long agent sessions?
By establishing concise procedural boundaries and deterministic validation gates rather than polluting system prompts with redundant rules. Agents reference targeted YAML triggers and execute focused SOP steps without unnecessary conversational bloat.
Q:Does this skill require escalated root or container permissions?
No. It is audited with a security score of 98/100 and runs safely within workspace-scoped sandboxes with 'fs_write: workspace', 'shell_exec: false', and 'net_access: false'.
Ready to equip your autonomous agent with AWS SNS to SQS Fan-Out Messaging & Dead-Letter Queues?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.