14 - Decoupling Applications SQS SNS Kinesis MQ

Amazon SNS

awssnspub-submessagingsaa-c03

Overview

What if you want to send one message and have many receivers? A direct integration (a buying service calling an email service, a fraud service, a shipping service and an SQS queue) is cumbersome: every new receiver means writing a new integration. Instead use the Pub/Sub (publish-subscribe) pattern. The buying service publishes one message to an SNS topic, and the topic has many subscribers, each of which receives the message. Compare with point-to-point queues in 02-SQS-Standard-Queues and the basics in 01-Introduction-to-Messaging.

How SNS Works

  • The event producer sends messages to one SNS topic.
  • Event receivers (subscriptions) listen to the topic notifications.
  • Each subscriber gets all messages sent to the topic, unless you use a message filter (see 08-SNS-SQS-Fan-Out-Pattern).
  • Publish with the topic publish SDK: create a topic, create one or many subscriptions, publish to the topic, and all subscribers receive the message automatically.
  • Direct publish is for mobile apps with the SDK: create a platform application and a platform endpoint, then publish to the platform endpoint. Works with Google GCM, Apple APNS and Amazon ADM.

Limits

Item Value (can change over time)
Subscriptions per topic 12,000,000+ (another lecture says 12,500,000)
Topics per account 100,000 (limit can be increased)
Limits

The instructor says you are never tested on the limits themselves for SNS. The numbers only give an idea of scale.

Subscribers (Who Can Receive)

Type Notes
Email Send emails directly from SNS
SMS and mobile notifications
HTTP / HTTPS endpoints Send data to specified endpoints
SQS Message goes straight into a queue
Lambda Function runs code after the message is received
Kinesis Data Firehose Send data on to, for example, Amazon S3 or Redshift

SNS topic and subscribers

Event producerpublishes once SNS topicpub/sub Email SMS and mobile notifications HTTP / HTTPS endpoint SQS queue Lambda Kinesis Data Firehose
One publish to the topic reaches every subscriber.

AWS Services That Publish to SNS

Many services send notifications into a specified SNS topic: CloudWatch Alarms, Auto Scaling Group notifications, CloudFormation state changes, Budgets, S3 buckets, DMS, Lambda, DynamoDB, RDS events, and so on. You do not need to memorize them. Any notification event within AWS can go to an SNS topic.

Security

Area Detail
In-flight encryption On by default
At-rest encryption KMS keys
Client-side encryption The client does the encryption and decryption itself
IAM policies Central to security, as all SNS APIs are regulated by IAM policies
SNS access policies Similar to S3 bucket policies. Used for cross-account access to topics and to allow other services (for example S3 events) to write to a topic

SNS has the same kind of security as SQS.

Topic Types

Standard topic FIFO topic
Ordering Best-effort message ordering Strictly preserved ordering
Delivery At least once Exactly once
Throughput Highest publishes per second Higher limits now apply, including a high-throughput mode (course said 300 publishes per second)
Subscribers SQS, Lambda, HTTPS, SMS, email, mobile application endpoints Only SQS queues
Naming Name must end with .fifo
AWS update (2025-01)

FIFO topic "up to 300 publishes per second" is outdated: higher limits now apply, including a high-throughput mode. The course said 300 per second. The exam may still use the course figure. AWS source

AWS update (2026-09)

SNS messages can now be up to 1 MiB via the topic attribute MaximumMessageSize. Above 256 KiB, only SQS, Data Firehose and Lambda subscriptions work. The course used 256 KB. AWS source

Hands-On Walkthrough

Create the topic

  1. Open the Simple Notification Service and create a topic named MyFirstTopic. Choose type Standard.
  2. Optional: enable encryption of messages and set an access policy. The access policy defines who and what can write to the topic, like an S3 bucket policy or an SQS access policy. Example: it lets an S3 bucket write events into the topic, which sends data on to SQS. Use the basic policy here and click Create topic.
  3. The topic starts with zero subscriptions.

Create an email subscription

  1. Create a subscription. The protocol choices are Kinesis Data Firehose, SQS, Lambda, Email, Email-JSON, HTTP, HTTPS, SMS. You must remember these for the exam.
  2. Choose Email and enter an endpoint address. The demo uses a Mailinator public inbox as a temporary email.
  3. An optional subscription filter policy can limit which messages reach the subscription. It is skipped here.
  4. After creation the status is pending confirmation. Click the confirmation link in the email. After a refresh the subscription shows as Confirmed.

Publish

  1. Publish a message with body hello world.
  2. The inbox receives an AWS Notification Message from SNS saying hello world.

For the SQS fan-out pattern you would choose SQS as the protocol and subscribe many queues to the topic.

Clean up

Delete the subscription, then delete the topic by typing delete me.

Questions & Answers

Q1: What is the difference between SQS and SNS?

Answer:

SQS is a queue where consumers pull messages. SNS is Pub/Sub: you push one message and all subscribers receive a copy.

Q2: Which protocols can subscribe to an SNS topic?

Answer:

Kinesis Data Firehose, SQS, Lambda, Email, Email-JSON, HTTP, HTTPS and SMS (plus mobile endpoints).

Q3: How do you let S3 events write to an SNS topic?

Answer:

Add an SNS access policy to the topic that allows S3 to publish. See 02-S3-Event-Notifications.

Q4: Which subscribers can a FIFO topic have?

Answer:

Only SQS queues, and the topic name must end with .fifo.

Q5: How is SNS encrypted?

Answer:

In-flight by default, at-rest with KMS keys, and optionally client-side.

Check yourself

Quiz

Flashcards

Click the card (or focus it), then use ← → to move and Space to flip.