SQS Account

Overview

You can use this account type to connect to Amazon SQS Snaps with data sources that use SQS Account

Account settings

Prerequisites

The permission policies, set up by the account administrator, govern all the SQS resources. These policies can either be identity-based or set up separately for SQS. Ensure that your SQS account has the appropriate permission policy when setting it up in SnapLogic. The permissions that you need depend on the Snap that uses the account:


Snap	Required permissions
All SQS Snaps	`sqs:ListQueues`: Validates the account and populates the suggestible list of queues in SnapLogic. `sqs:GetQueueUrl` and `sqs:GetQueueAttributes`: Accesses the queue. Without these permissions, the Snap fails with an `AWS.SimpleQueueService.NonExistentQueue` error even when the queue exists.
SQS Producer	The permissions listed for all SQS Snaps and `sqs:SendMessage` to write messages to the queue.
SQS Consumer	The permissions listed for all SQS Snaps and `sqs:ReceiveMessage` to read messages from the queue. If Auto acknowledge is selected, the Snap also requires `sqs:DeleteMessage`.
SQS Acknowledge	The permissions listed for all SQS Snaps and `sqs:DeleteMessage` to delete the message by receipt handle.

Additionally, verify that the queue's resource-based access policy (set in the Amazon SQS console under Access Policy) also grants the required actions. IAM permissions alone are not sufficient if the queue policy restricts access. For example, a queue policy that grants only sqs:SendMessage blocks the account validation and queue lookup calls, whereas sqs:* grants all actions on that queue. Action names are not case-sensitive, so the console might display the service prefix as SQS:.

If your account uses the Cross account IAM role field set, the target account also requires a trust policy that permits sts:AssumeRole. For more information, see Configuring Cross Account IAM Role Support for Amazon SQS Snaps.

For more information, see Access Management Overview.

Behavior changes

With the 432patches19990, the Amazon SQS Account reauthenticates when the authentication expires; the account automatically retires authentication on encountering 401 or 403 errors.

Legend:

Expression icon (): Allows using JavaScript syntax to access SnapLogic Expressions to set field values dynamically (if enabled). If disabled, you can provide a static value. Learn more.
SnapGPT (): Generates SnapLogic Expressions based on natural language using SnapGPT. Learn more.
Suggestion icon (): Populates a list of values dynamically based on your Snap configuration. You can select only one attribute at a time using the icon. Type into the field if it supports a comma-separated list of values.
Upload : Uploads files. Learn more.

Learn more about the icons in the Snap settings dialog.


Field/Field set	Type	Description
Label `String`	String	Required.Specify a unique label for the account. Default value: N/A Example: SQS Account
Access-key Id	String/Expression	Specify the access key ID of AWS authentication. Default value: User credentials Example: LKIAIVKOR4AP72KVCWLA
Secret key	String/Expression	Specify the secret key of AWS authentication. Default value: N/A Example: 7FTUHh7aMlBM5CX1ayyxy
Security token	String/Expression	Specify a security token that is part of AWS Security Token Service (STS) credentials. Note that only global Security Token Service (STS) regions are supported. Default value: N/A Example: z7PmG8F6DY5xblJHwN
IAM role	Checkbox	Select this checkbox to enable the IAM role stored in the EC2 instance to access SQS. Access-key ID and Secret key are ignored. Note: This feature is valid only in EC2-type Groundplex. Refer to the Snap reference document for the required entry in the global properties file. Default status: Deselected Example: Encrypted
Cross account IAM role	Use this field set to set up cross-account IAM role access. It consists of the following fields: Role ARN External ID
Role ARN	String/Expression	Specify the Amazon Resource Name of the role to assume. Default value: N/A Example: arn:aws"iam:3443454566774:role/IAMRolewithaccess
External ID	String/Expression	Specify an external ID that might be required by the role to assume. Default value: N/A Example: 795735
Enable Large Message Support	Checkbox	Specify the AWS region where your Amazon Athena service is activated. Default status: Deselected Example: ap-east-1
S3 Configuration	Appears when Enable Large Message Support checkbox is selected. Use this field set to configure the S3 bucket details. It consists of the following fields: S3 Bucket S3 Bucket Region S3 Credentials Default value: N/A Example: AWS Data Catalog
S3 Bucket	String/Expression	Specify the S3 Bucket name residing in an external AWS account. Important: If the field is lefty empty, the default region (the region of the EC2 instance, or us-west-2 if the JCC is not on a EC2) will be used. Default value: primary Example: sandbox-s3-bucket
S3 Bucket Region	String/Expression	Specify the region where the S3 Bucket is residing. Default value: N/A Example: us-west-2
S3 Credentials	String/Expression	Choose the S3 credentials for the S3 bucket. The available options are: Use SQS Credentials Provide Separate Credentials Default value: None Example: Provide Separate Credentials
S3 Access Key ID	String/Expression	Specify the S3 secret key associated with the S3 Access-ID key listed in the S3 Access-key ID field. Default value: N/A Example: abcd1234-a567-8901-2345-67890abcdef
Use EC2 Role	Checkbox	Select this checkbox to use Amazon Elastic Cloud Compute Role. Default status: Deselected
Assumed Role ARN	String/Expression	Specify the Amazon Resource Name of the role to assume. Default value: N/A Example: arn:aws:s3:::sandbox-test-snap
Assumed Role External ID	String/Expression	Specify an optional external ID that might be required by the role to assume. Default value: N/A Example: 321f248c-8f4a-21be-87c4-184c9f8e2d03

Troubleshooting


Error	Reason	Resolution
`Invalid account configuration.`	You might have entered empty or null values in Cross Account IAM Role fields.	Enter valid values for Cross Account IAM Role.
`AWS.SimpleQueueService.NonExistentQueue`	The IAM policy is missing `sqs:GetQueueUrl` or `sqs:GetQueueAttributes`, or the queue's resource-based policy restricts access.	Add `sqs:GetQueueUrl` and `sqs:GetQueueAttributes` to the IAM policy, and verify the queue's Access Policy in the Amazon SQS console.
`MISSING_GROUP_ID`	Message group ID is missing.	Message group ID is mandatory for FIFO Queue. Enter a valid Message group ID.
`BUFFER_NOT_SUPPORT_FIFO`	Client-side buffering cannot be enabled for FIFO Queue.	Deselect client-side buffering or use standard queue.
`VALIDATE_ACCOUNT_WITH_EXPRESSION`	One or more Pipeline parameters must be configured in the Pipeline. Validation is not applicable for Pipeline parameters.	Do not validate the account if you provide Pipeline parameters.
`ACCOUNT_CREDENTIALS_MISSING`	Either Access key and secret key might be empty.	You must provide valid credentials for SQS if the IAM role is disabled.