Messaging — konfig-konector Docs

SQSQueue # ✅ Working

Creates and manages an SQS queue (standard or FIFO). Supports visibility timeout, message retention, delay queues, KMS encryption, resource policies, and dead-letter queue redrive policies.

Spec

Field	Type	Required	Description
queueName	string	✅	Queue name. FIFO queues must end with `.fifo`. Immutable after creation.
fifo	bool		Create a FIFO queue. Default: false. Immutable.
visibilityTimeout	int32		Seconds a message is hidden after being received (0–43200). Default: 30.
messageRetentionPeriod	int32		Seconds messages are retained (60–1209600). Default: 345600 (4 days).
delaySeconds	int32		Seconds to delay delivery of all messages (0–900). Default: 0.
receiveMessageWaitTime	int32		Seconds for long polling (0–20). Set to 20 to enable long polling.
kmsKeyId	string		KMS key ID or ARN for server-side encryption.
policy	string		JSON resource policy for the queue.
redrivePolicy.deadLetterQueueRef	string		Name of the `SQSQueue` CR to use as the dead-letter queue.
redrivePolicy.maxReceiveCount	int32		Number of times a message can be received before being sent to the DLQ.
tags	map[string]string		AWS tags applied to the queue.

Status

Field	Description
queueUrl	The URL of the SQS queue.
queueArn	The ARN of the SQS queue.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example — Standard Queue with DLQ

apiVersion: aws.konfig.io/v1alpha1
kind: SQSQueue
metadata:
  name: order-processing-dlq
  namespace: messaging
spec:
  queueName: order-processing-dlq
  messageRetentionPeriod: 1209600  # 14 days
  tags:
    env: prod
    purpose: dlq
---
apiVersion: aws.konfig.io/v1alpha1
kind: SQSQueue
metadata:
  name: order-processing
  namespace: messaging
spec:
  queueName: order-processing
  visibilityTimeout: 300
  messageRetentionPeriod: 86400
  receiveMessageWaitTime: 20
  redrivePolicy:
    deadLetterQueueRef: order-processing-dlq
    maxReceiveCount: 5
  tags:
    env: prod
    service: orders

Example — FIFO Queue

apiVersion: aws.konfig.io/v1alpha1
kind: SQSQueue
metadata:
  name: payment-events-fifo
  namespace: messaging
spec:
  queueName: payment-events.fifo
  fifo: true
  visibilityTimeout: 60
  messageRetentionPeriod: 345600
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/mrk-abc123
  tags:
    env: prod
    service: payments

Example — Queue with Resource Policy (Allow SNS)

apiVersion: aws.konfig.io/v1alpha1
kind: SQSQueue
metadata:
  name: notifications-queue
  namespace: messaging
spec:
  queueName: notifications-queue
  visibilityTimeout: 30
  policy: |
    {
      "Version": "2012-10-17",
      "Statement": [{
        "Sid": "AllowSNSPublish",
        "Effect": "Allow",
        "Principal": { "Service": "sns.amazonaws.com" },
        "Action": "sqs:SendMessage",
        "Resource": "arn:aws:sqs:us-east-1:123456789012:notifications-queue",
        "Condition": {
          "ArnEquals": {
            "aws:SourceArn": "arn:aws:sns:us-east-1:123456789012:notifications-topic"
          }
        }
      }]
    }
  tags:
    env: prod

Notes

queueName is immutable after creation.
FIFO queues have lower throughput (3000 messages/second with batching, 300 without) compared to standard queues.
All attributes are applied via SetQueueAttributes on every reconcile.
SQS queue ARNs follow the pattern arn:aws:sqs:<region>:<account>:<queue-name>.

Deletion

Immediate. The queue and all in-flight messages are permanently deleted. There is no recovery. Ensure consumers have processed all messages before deletion.

SNSTopic # ✅ Working

Creates and manages an SNS topic (standard or FIFO). Supports KMS encryption and resource-based policies for cross-account access.

Spec

Field	Type	Required	Description
topicName	string	✅	Topic name. FIFO topics must end with `.fifo`. Immutable after creation.
fifo	bool		Create a FIFO topic. Default: false. Immutable.
contentBasedDeduplication	bool		Enable content-based deduplication for FIFO topics.
kmsKeyId	string		KMS key ID or ARN for server-side encryption of messages.
policy	string		JSON resource policy for the topic.
tags	map[string]string		AWS tags applied to the topic.

Status

Field	Description
topicArn	The ARN of the SNS topic.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example — Standard Topic with KMS

apiVersion: aws.konfig.io/v1alpha1
kind: SNSTopic
metadata:
  name: notifications-topic
  namespace: messaging
spec:
  topicName: notifications-topic
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/mrk-abc123
  tags:
    env: prod
    service: notifications

Example — FIFO Topic with Deduplication

apiVersion: aws.konfig.io/v1alpha1
kind: SNSTopic
metadata:
  name: payment-events-topic
  namespace: messaging
spec:
  topicName: payment-events.fifo
  fifo: true
  contentBasedDeduplication: true
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/mrk-abc123
  tags:
    env: prod
    service: payments

Notes

topicName is immutable after creation.
Use SNSSubscription CRs to fan out messages to SQS, Lambda, HTTPS, email, and other endpoints.
contentBasedDeduplication is only valid for FIFO topics.

Deletion

Immediate. The topic and all its subscriptions are deleted. Messages in transit are lost.

SNSSubscription # ✅ Working

Subscribes an endpoint to an SNS topic. Supports SQS, Lambda, HTTPS, HTTP, email, email-json, SMS, application, and Firehose protocols. Filter policies allow selective message delivery.

Spec

Field	Type	Required	Description
topicRef.name	string	✅	Name of the `SNSTopic` CR in the same namespace.
topicRef.arn	string		Direct SNS topic ARN (alternative to `topicRef.name`).
protocol	string	✅	Subscription protocol: `sqs`, `lambda`, `https`, `http`, `email`, `email-json`, `sms`, `application`, `firehose`.
endpoint	string	✅	The endpoint to receive messages (SQS ARN, Lambda ARN, HTTPS URL, email address, etc.).
filterPolicy	string		JSON filter policy to selectively receive messages matching specific attributes.
rawMessageDelivery	bool		Deliver the raw message without SNS JSON wrapper. Recommended for SQS subscribers.

Status

Field	Description
subscriptionArn	The ARN of the subscription. May be `PendingConfirmation` for email subscriptions until confirmed.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example — SNS to SQS Fan-Out

apiVersion: aws.konfig.io/v1alpha1
kind: SNSSubscription
metadata:
  name: notifications-to-queue
  namespace: messaging
spec:
  topicRef:
    name: notifications-topic
  protocol: sqs
  endpoint: arn:aws:sqs:us-east-1:123456789012:notifications-queue
  rawMessageDelivery: true

Example — Filtered Subscription

apiVersion: aws.konfig.io/v1alpha1
kind: SNSSubscription
metadata:
  name: critical-alerts-to-lambda
  namespace: messaging
spec:
  topicRef:
    name: notifications-topic
  protocol: lambda
  endpoint: arn:aws:lambda:us-east-1:123456789012:function:alert-handler
  filterPolicy: |
    {
      "severity": ["CRITICAL", "HIGH"],
      "environment": ["prod"]
    }

Example — HTTPS Webhook

apiVersion: aws.konfig.io/v1alpha1
kind: SNSSubscription
metadata:
  name: notifications-webhook
  namespace: messaging
spec:
  topicRef:
    name: notifications-topic
  protocol: https
  endpoint: https://hooks.example.com/sns-receiver
  rawMessageDelivery: false

Notes

For SQS subscriptions, the target queue must have a resource policy that allows sqs:SendMessage from the SNS topic. See the SQS queue policy example above.
Email subscriptions require manual confirmation — the recipient must click the confirmation link sent by SNS. The subscription will remain in PendingConfirmation state until confirmed.
rawMessageDelivery: true is recommended for SQS subscribers to avoid double-encoding the SNS envelope.
Filter policies use attribute matching — messages must have matching MessageAttributes to be delivered.

Deletion

Immediate. The subscription is deleted. The SNS topic and endpoint (SQS queue, Lambda function, etc.) are unaffected.