Tendrl

Docs / Strand / connectors/aws-sqs

AWS SQS

Direction: Read / Write | Type: aws.sqs

Amazon Simple Queue Service connector for sending and receiving messages from SQS queues.

Required Permissions

The IAM user or role must have the following permissions:

Operation Required IAM Permissions
send_message sqs:SendMessage
receive_message sqs:ReceiveMessage, sqs:DeleteMessage
Tip: Scope permissions to specific queue ARNs to follow the principle of least privilege.

Operations

Operation Direction Description
send_message Write Send a message to the queue
receive_message Read Receive messages from the queue

Connector Configuration

Field Required Default Description
Authentication Type No api_key api_key for explicit credentials, role to use the host's IAM role / default credential chain
Region Yes - AWS region code (e.g., us-east-1)
Endpoint URL No - Custom endpoint for a self-managed target or an AWS VPC endpoint. Leave empty for AWS.
Access Key ID Conditional - AWS access key (encrypted). Required when Authentication Type is api_key
Secret Access Key Conditional - AWS secret key (encrypted). Required when Authentication Type is api_key
Role ARN Conditional - Your IAM role ARN for cross-account access via STS AssumeRole. Required when Authentication Type is role. The role must trust the Tendrl AWS account.
External ID No - External ID for STS AssumeRole (encrypted). Recommended with role auth to prevent confused-deputy attacks.
Queue URL No - Default SQS queue URL (can be overridden at node level)
Role-Based Authentication

With role authentication you do not store static access keys; Strand authenticates using the host's default credential chain (EC2 instance profile, ECS task role, or environment credentials). You must still provide a Role ARN when creating the connector (the role should trust the Tendrl AWS account); an optional External ID hardens the trust policy.

Node Configuration

Field Required Description
Operation Yes send_message or receive_message
Queue URL No SQS queue URL (overrides connector default)
Max Messages No Maximum messages to receive (default: 1, for receive_message only)

Output

send_message

json

{
  "success": true,
  "status": "sent",
  "data": {
    "message_id": "abc-123-def",
    "queue_url": "https://sqs.us-east-1.amazonaws.com/123456789/my-queue"
  },
  "service": "aws.sqs",
  "operation": "send_message"
}

receive_message

json

{
  "success": true,
  "status": "received",
  "data": {
    "messages": [{"key": "value"}],
    "count": 1
  },
  "service": "aws.sqs",
  "operation": "receive_message"
}

When the queue is empty:

json

{
  "success": true,
  "status": "empty",
  "data": {
    "messages": [],
    "count": 0
  },
  "service": "aws.sqs",
  "operation": "receive_message"
}

Access received messages:

jinja2

{{ payload.data.messages[0] }}
{{ payload.data.count }}

Example

Connector Setup:

json

{
  "region": "us-east-1",
  "access_key_id": "AKIAIOSFODNN7EXAMPLE",
  "secret_access_key": "wJalrXUtnFEMI/K7MDENG...",
  "queue_url": "https://sqs.us-east-1.amazonaws.com/123456789/my-queue"
}

Connector Setup (role-based):

json

{
  "auth_type": "role",
  "region": "us-east-1",
  "role_arn": "arn:aws:iam::123456789012:role/strand-access",
  "queue_url": "https://sqs.us-east-1.amazonaws.com/123456789/my-queue"
}

Node Configuration (send):

Node Configuration (receive):

← Back to Strand docs