Amazon SQS

Each outbound message becomes one SendMessage call. The message body is the payload, and the signature attributes go in as SQS message attributes (type String). Requires the Starter plan or above.

Settings

Field	Required	Notes
`queueUrl`	Yes	`https://sqs.<region>.amazonaws.com/<account id>/<queue name>`. The region is taken from it.
`messageGroupId`	FIFO only	Required for `.fifo` queues. Hookbase uses the message id as the deduplication id, so a retry of the same message is deduplicated.
`accessKeyId` / `secretAccessKey`	Yes	An IAM user or role key with the policy below.

IAM policy

Grant only sqs:SendMessage on the one queue:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:orders"
    }
  ]
}

If the queue uses a customer-managed KMS key, also allow kms:GenerateDataKey and kms:Decrypt on that key.

Reading and verifying

import { Webhook } from 'standardwebhooks';
import { SQSClient, ReceiveMessageCommand } from '@aws-sdk/client-sqs';
 
const wh = new Webhook(process.env.HOOKBASE_SIGNING_SECRET);
const sqs = new SQSClient({});
const { Messages = [] } = await sqs.send(new ReceiveMessageCommand({
  QueueUrl: process.env.QUEUE_URL,
  MessageAttributeNames: ['All'],
}));
 
for (const m of Messages) {
  const headers = Object.fromEntries(
    Object.entries(m.MessageAttributes ?? {}).map(([k, v]) => [k, v.StringValue]),
  );
  const event = wh.verify(m.Body, headers); // throws if the signature doesn't match
  // ...handle event, then DeleteMessage
}

SQS limits a message, attributes included, to 256 KB. Larger payloads fail with a permanent error and are dead-lettered. For large payloads, use S3 instead.