How do I troubleshoot Amazon SQS DLQ redrive issues?

Resolution

Grayed out "Start DLQ redrive" icon

If you don't configure the Amazon SQS queue as a DLQ, then the Start DLQ Redrive icon is inaccessible in the Amazon SQS console.

For more information, see Configuring a dead-letter queue redrive.

"Failed: CouldNotDetermineMessageSource" error

If the DLQ has one of these messages, then you might receive this error when you try to start a DLQ redrive to the source queue:

• An Amazon SQS message that's sent with the SendMessage API call to the DLQ.
• A message from the Amazon Simple Notification Service (Amazon SNS) topic or AWS Lambda function that has the DLQ configured.

To resolve this error, choose Redrive to a custom destination when you start the redrive. Then, enter the Amazon SQS queue ARN to move all messages from the DLQ to the destination queue.

"Failed: AWS.SimpleQueueService.NonExistentQueue" error

This error occurs when the DLQ redrive fails because the Amazon SQS source queue doesn't exist or was deleted.

"Failed to create redrive task. Error code: AccessDenied - Queue Permissions to Redrive" error

This error occurs when the DLQ redrive fails because the AWS Identity and Access Management (IAM) entity doesn't have the required permissions. The following API permissions are required to make DLQ redrive requests:

• StartMessageMoveTask
• CancelMessageMoveTask
• ListMessageMoveTask

For server-side encryption (SSE) queues, the following AWS Key Management Service (AWS KMS) key policy permission is required:

{
    "Version": "2012-10-17",
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes",
                "sqs:StartMessageMoveTask",
                "sqs:ListMessageMoveTasks",
                "sqs:CancelMessageMoveTask"
            ],
            "Resource": "arn:aws:sqs:<DLQ_region>:<DLQ_accountId>:<DLQ_name>"
        },
        {
            "Effect": "Allow",
            "Action": "sqs:SendMessage",
            "Resource": "arn:aws:sqs:<DestQueue_region>:<DestQueue_accountId>:<DestQueue_name>"
        }
    ]
}

For more information, see How do I troubleshoot "AccessDenied" or "AccessDeniedException" errors on Amazon SQS API calls?

Important: If you used the Amazon SQS console to configure your queue permissions for the DLQ redrive before August 31st 2023, then make sure that you update your permissions.

Related information

What permissions do I need to access an Amazon SQS queue?

Why is my Lambda function retrying valid Amazon SQS messages and placing them in my dead-letter queue?

Amazon SQS announces support for FIFO dead-letter queue redrive