Create an SQS action

Create an Amazon Simple Queue Service (SQS) action in the Admin Portal to forward matching events from an Events & Actions listener to an Amazon SQS queue. Before you configure the action, create a queue and an Identity and Access Management (IAM) role in AWS that lets PubNub write to it.

Use Terraform instead of the AWS console

1resource "aws_sqs_queue" "pubnub_queue" {
2  name       = "pubnub-example"
3  fifo_queue = false
4}
5

6data "aws_iam_policy_document" "pubnub_sqs_role" {
7  statement {
8    actions = ["sts:AssumeRole"]
9

10    principals {
11      type        = "AWS"
12      identifiers = ["arn:aws:iam::535363102202:root"]
13    }
14

15    condition {
16      test     = "StringLike"
17      variable = "sts:ExternalId"
18

19      values = [
20        "<PubNub subscribe key>"
21      ]
22    }
23  }
24}
25

26resource "aws_iam_role" "pubnub_sqs_example" {
27  name               = "pubnub-sqs-example"
28  path               = "/"
29  assume_role_policy = data.aws_iam_policy_document.pubnub_sqs_role.json
30}
31

32resource "aws_iam_policy" "pubnub_sqs_example" {
33  name        = "pubnub-sqs-example"
34  path        = "/"
35  description = "Pubnub Example SQS policy"
36

37  policy = jsonencode({
38    Version = "2012-10-17"
39    Statement = [
40      {
41        Action = [
42          "sqs:SendMessage",
43        ]
44        Effect   = "Allow"
45        Resource = aws_sqs_queue.pubnub_queue.arn
46      },
47    ]
48  })
49}
50

51resource "aws_iam_role_policy_attachment" "pubnub-sqs-attach" {
52  role       = aws_iam_role.pubnub_sqs_example.name
53  policy_arn = aws_iam_policy.pubnub_sqs_example.arn
54}

show all 54 lines

If you use this Terraform configuration, skip ahead to configure the action in the Admin Portal.

Create a queue

1. Open Amazon SQS and go to Queues.

2. Click Create queue and enter a name.

   Events & Actions supports the standard queue type. It doesn't support FIFO queues.

3. Click Create queue to save it.

4. Copy the Queue URL. You need it to configure the action.

Create an IAM role

Create an IAM role that grants PubNub write access to your queue. An IAM role is an AWS identity with a set of permissions, and it doesn't belong to a single user.

1. Open AWS Identity and Access Management and go to Roles.

2. Click Create role and name the role.

3. Set AWS account as the Trusted entity type.

4. Under An AWS account, select Another AWS account and enter 535363102202 as the Account ID. This is PubNub's AWS account ID, and this trust relationship is what lets PubNub write to your queue.

5. Select Require external ID.

6. Paste your app's subscribe key from the keyset's page in the Admin Portal into External ID. AWS recommends this step, though it isn't required. It scopes the trust relationship so only requests carrying your subscribe key as the external ID can assume the role. For example:

   1{
   2    "Version": "2012-10-17",
   3    "Statement": [
   4        {
   5            "Effect": "Allow",
   6            "Principal": {
   7                "AWS": "arn:aws:iam::535363102202:root"
   8            },
   9            "Action": "sts:AssumeRole",
   10            "Condition": {
   11                "StringEquals": {
   12                    "sts:ExternalId": "<PubNub subscribe key>"
   13                }
   14            }
   15        }
   16    ]
   17}

   show all 17 lines

   Click Next.

7. Create a policy that grants sqs:SendMessage. Click Create policy, switch to the JSON editor, and paste this snippet, replacing the resource with your queue's Amazon Resource Name (ARN), the unique identifier AWS assigns to the queue:

   1{
   2    "Statement": [
   3        {
   4            "Action": [
   5                "sqs:SendMessage"
   6            ],
   7            "Effect": "Allow",
   8            "Resource": "<ARN of your SQS queue>"
   9        }
   10    ],
   11    "Version": "2012-10-17"
   12}

   Complete the policy in the wizard.

8. Select the new policy and click Next.

9. Name the role and click Create Role.

10. Copy the Role ARN. You need it to configure the action.

Configure the action

1. Open Events & Actions on the Admin Portal and click + Add Action.
2. Select Amazon SQS.
3. Paste the Queue URL and Role ARN you copied earlier.
4. If you want PubNub to retry failed deliveries automatically, turn on SQS retry and set the retry count and interval. When a delivery is retried, PubNub adds retry metadata to the event payload. See Available actions for the full retry mechanics, including the jitter formula.
5. Pair the action with an event listener without leaving Actions. Click Add event listener and select an existing listener, or create one first.
6. Click Save changes.

Confirm messages arrive in your queue

Publish a message, or trigger whichever event you configured, so it matches your listener's filter. For how publishing works, see Publishing messages with PubNub. Then check your queue in the Amazon SQS console for a new message. For the exact JSON structure PubNub sends, see Payloads.

If no message arrives, confirm the action is paired with a listener whose filter matches the event you triggered. Also confirm the IAM role's policy grants sqs:SendMessage on that exact queue ARN.

Related tasks

• Configure Events & Actions. Create the event listener that triggers this action.
• Create a Kinesis action. Forward events to a real-time data stream instead of a queue.
• Available actions. Compare an SQS action against other ways to forward events.
• Payloads. Look up the exact JSON your queue receives for each event type.