AWS Lambda 未向 AWS SQS DLQ 发送错误消息

Question

I'm trying to create via terraform, a lambda that triggered by Kinesis and her destination on failures will be AWS SQS.

I created and lambda and configured the source and destination

When I'm sending a message to Kinesis queue, the lambda is triggered but not sending messages to the DLQ.

What am I missing?

my labmda source mapping:

resource "aws_lambda_event_source_mapping" "csp_management_service_integration_stream_mapping" {
  event_source_arn               = local.kinesis_csp_management_service_integration_stream_arn
  function_name                  = module.csp_management_service_integration_lambda.lambda_arn
  batch_size                     = var.shared_kinesis_configuration.batch_size
  bisect_batch_on_function_error = var.shared_kinesis_configuration.bisect_batch_on_function_error
  starting_position              = var.shared_kinesis_configuration.starting_position
  maximum_retry_attempts         = var.shared_kinesis_configuration.maximum_retry_attempts
  maximum_record_age_in_seconds  = var.shared_kinesis_configuration.maximum_record_age_in_seconds
  function_response_types        = var.shared_kinesis_configuration.function_response_types
  destination_config {
    on_failure {
      destination_arn = local.shared_default_sqs_error_handling_dlq_arn
    }
  }
}

resource "aws_iam_policy" "shared_deadletter_sqs_queue_policy" {
  name = "shared-deadletter-sqs-queue-policy"
  path = "/"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action   = [
          "sqs:SendMessage",
        ]
        Effect   = "Allow"
        Resource = [
          local.shared_default_sqs_error_handling_dlq_arn
        ]
      },
    ]
  })
}

Answer 1

I think you are facing some permission issue, try attaching a role to your lambda function with access to AWS SQS DLQ.

Answer 2

You should take a look on the following metric to see if you have permission error

Answer 3

1. Is your DLQ encrypted by KMS? You will need top provide permissions to the KMS too in addition to SQS permissions

2. How is Lambda reporting failure?