SQS circular dependencies when specify redrive allow policy by queue on dead letter queue

[supavit28]

I am using AWS CDK on Python and would like to create SQS which has dead letter queue and want to add redrive allow policy to let only associated queue and redrive it.

Here is my sample code

from aws_cdk import sqs
from constructs import Construct

class MyStack(Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        **kwargs,
    ) -> None:
    super().__init__(scope, construct_id, **kwargs)

    dead_letter_queue = sqs.Queue(
        self,
        dead_letter_queue_name,
        queue_name=f"{dead_letter_queue_name}",
        redrive_allow_policy=sqs.RedriveAllowPolicy(
            redrive_permission=sqs.RedrivePermission.BY_QUEUE,
            source_queues=[queue], # Require source IQueue (source queue) to be created first
        ),
    )
    queue = sqs.Queue(
        self,
        queue_name,
        queue_name=f"{queue_name}",
        dead_letter_queue=sqs.DeadLetterQueue(
            max_receive_count=3,
            queue=dead_letter_queue, # Require dead letter queue to be created first
        ),
    )

Both of them require each other to be created first, I am just newbie on CDK so how can I solve this problem.

Thanks in advance.

[nywhere]

I'm running into the same issue. Is there a solution to that?

[supavit28]

I have to create 2 queue separately then attach minimum policies for redrive message back to source queue. Please find my sample codes below, hope it help

In code I also set cloudwatch alarm to send SNS when there is any message coming into DLQ too.

from aws_cdk import (
    Duration,
    Stack,
    aws_sqs as sqs,
    aws_iam,
    aws_cloudwatch as cloudwatch,
    aws_cloudwatch_actions as cw_actions,
)
from constructs import Construct

class MyStack(Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        settings: dict,
        **kwargs,
    ) -> None:
        
        super().__init__(
            scope,
            construct_id,
            **kwargs,
        )
        self.dlq_alert_topic = settings.get("dlq_alert_topic")
        self.create_queue(
            settings.get("queue_name"),
            create_dead_letter_queue=True,
            timeout=settings.get("visibility_timeout", 30),
            retention=settings.get("retention", 345600),
            dlq_retry=settings.get("dlq").get("retry"),
            dlq_timeout=settings.get("dlq").get("visibility_timeout", 30),
            dlq_retention=settings.get("dlq").get("retention", 345600),
        )


    def create_queue(
        self,
        queue_name,
        timeout=30,  # Visibility timeout in seconds
        retention=345600,  # Retention period in seconds
        create_dead_letter_queue=False,
        **kwargs,
    ):
        if create_dead_letter_queue:
            dead_letter_queue_name = f"{queue_name}-DLQ"

            # Create dead letter queue
            dead_letter_queue = sqs.Queue(
                self,
                f"{dead_letter_queue_name}",
                queue_name=f"{dead_letter_queue_name}",
                visibility_timeout=Duration.seconds(kwargs.get("dlq_timeout", 30)),
                retention_period=Duration.seconds(kwargs.get("dlq_retention", 345600)),
            )
            # Create source queue
            queue = sqs.Queue(
                self,
                queue_name,
                queue_name=f"{queue_name}",
                visibility_timeout=Duration.seconds(timeout),
                retention_period=Duration.seconds(retention),
                dead_letter_queue=sqs.DeadLetterQueue(
                    max_receive_count=kwargs.get("dlq_retry", 1),
                    queue=dead_letter_queue,
                ),
            )
            # Add policy to allow redrive messaage
            # Ref: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-dead-letter-queue-redrive.html
            dead_letter_queue.add_to_resource_policy(
                statement=aws_iam.PolicyStatement(
                    actions=[
                        "sqs:StartMessageMoveTask",
                        "sqs:ReceiveMessage",
                        "sqs:DeleteMessage",
                        "sqs:GetQueueAttributes",
                        "sqs:CancelMessageMoveTask",
                        "sqs:ListMessageMoveTasks",
                    ],
                    effect=aws_iam.Effect.ALLOW,
                    principals=[aws_iam.ServicePrincipal("sqs.amazonaws.com")],
                    resources=[dead_letter_queue.queue_arn],
                )
            )
            dead_letter_queue.add_to_resource_policy(
                statement=aws_iam.PolicyStatement(
                    actions=["sqs:SendMessage"],
                    effect=aws_iam.Effect.ALLOW,
                    principals=[aws_iam.ServicePrincipal("sqs.amazonaws.com")],
                    resources=[queue.queue_arn],
                )
            )

            # Create cloudwatch alarm
            visible_message_metric = cloudwatch.Metric(
                namespace="AWS/SQS",
                metric_name="ApproximateNumberOfMessagesVisible",
                dimensions_map={"QueueName": dead_letter_queue.queue_name},
                statistic="Sum",
                period=Duration.minutes(1),
            )
            not_visible_message_metric = cloudwatch.Metric(
                namespace="AWS/SQS",
                metric_name="ApproximateNumberOfMessagesNotVisible",
                dimensions_map={"QueueName": dead_letter_queue.queue_name},
                statistic="Sum",
                period=Duration.minutes(1),
            )
            rate_message_changed_metric = cloudwatch.MathExpression(
                expression="RATE(visible+not_visible)",
                using_metrics={
                    "visible": visible_message_metric,
                    "not_visible": not_visible_message_metric,
                },
                period=Duration.minutes(1),
                label="Rate of message changed in DLQ",
            )
            dlq_alarm = cloudwatch.Alarm(
                self,
                f"{queue_name}-DLQ-Alarm",
                alarm_name=f"{queue_name}-DLQ-Alarm",
                metric=rate_message_changed_metric,
                comparison_operator=cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
                threshold=0,
                evaluation_periods=1,
                datapoints_to_alarm=1,
            )
            dlq_alarm.add_alarm_action(cw_actions.SnsAction(self.dlq_alert_topic))