SQS queue should have a dead-letter queue configured

What it checks

SQS queue should have a dead-letter queue configured

Where it applies

Terraform: aws_sqs_queue

CloudFormation: AWS::SQS::Queue

How to fix it

1. Create a DLQ of the same FIFO or standard type as the source queue and set redrive_policy with deadLetterTargetArn and maxReceiveCount = 3 (adjustable). Set up a CloudWatch alarm on the DLQ ApproximateNumberOfMessagesVisible metric.

Frameworks

• AWS FSBP SQS.3
• SOC 2 CC7.3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules