Deliver to Amazon SQS

Route delivered events into an Amazon SQS queue. Emithook delivers from its own IAM principal and you grant it access with a queue policy — there are no per-destination access keys to create, rotate, or leak.

How delivery works

Emithook signs every delivery with a single, shared IAM principal (its own AWS account). To let it write to your queue, you add one statement to the queue's resource-based access policy granting that principal permission. This is standard AWS cross-account access — the same model SNS→SQS and EventBridge→SQS use.

emithook delivery worker  ──(SendMessage)──▶  your SQS queue
   principal: arn:aws:iam::589958197158:user/emithook
   authorized by: your queue's Access policy

Emithook needs two actions:

• sqs:SendMessage — deliver each event to the queue.
• sqs:GetQueueAttributes — the console's Reachable check calls this to confirm the grant took effect before you route traffic.

1. Find your queue URL and ARN

In the SQS console, open your queue. The URL looks like:

https://sqs.us-east-1.amazonaws.com/123456789012/my-queue

Its ARN is the same three parts rearranged:

arn:aws:sqs:us-east-1:123456789012:my-queue

(region → account id → queue name). The emithook console derives this ARN from the URL for you.

2. Add the queue policy

In the SQS console: your queue → Access policy → Edit, and paste the statement below (merge it into an existing policy's Statement array if you already have one). Replace Resource with your queue's ARN.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EmithookDelivery",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::589958197158:user/emithook" },
      "Action": ["sqs:SendMessage", "sqs:GetQueueAttributes"],
      "Resource": "<your-queue-arn>"
    }
  ]
}

Save the policy.

Region and ARN must match

The queue URL you register in emithook, its ARN in the policy, and the queue itself must all be in the same region. A mismatched region is the most common cause of a Queue not found reachability result.

Self-hosting

The principal ARN above is emithook's managed delivery identity. A self-hosted deployment publishes its own via SQS_DELIVERY_PRINCIPAL_ARN — the console always shows the correct ARN for the deployment you're using, so copy it from there rather than from this page.

3. Create the destination in emithook

In the console: Destinations → New destination → Amazon SQS, enter your queue URL, and copy the pre-filled queue policy (it already has the right principal ARN and your derived queue ARN). The access-key fields are gone — cross-account grants replace them.

Prefer the API? Create the destination with just the queue URL:

curl -X POST https://api.emithook.com/v1/destinations \
  -H "Authorization: Bearer $EK_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "orders-queue",
    "type": "sqs",
    "config": { "url": "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue" }
  }'

4. Verify with the Reachable indicator

Back in the console, the destination shows a reachability badge. Click Re-check — emithook calls GetQueueAttributes against your queue:

• Reachable ✓ — the policy is in effect; you can route endpoints to this destination.
• Not reachable ✗ with Access denied — the queue policy hasn't granted access yet (or is still propagating). Re-check after saving the policy.
• Not reachable ✗ with Queue not found — the URL or region is wrong; confirm the queue exists in that region.

Once it reads Reachable, add the destination to an endpoint's routes and events start flowing to your queue.