Other Articles
- EC2 Volume – Enable EBS Encryption
- EC2 Volume – Enable EBS Volume Backup
- EFS – Enable EFS Storage Backup
- EC2 Instance – Enable Deletion Protection
- EC2 Instance – Monitor CPU Utilization
- ECS Service – Monitor CPU Utilization
- ECS Service – Monitor Memory Utilization
- EC2 VPC – Ensure Flow Logs are Enabled
- S3 Bucket – Block S3 Bucket Public Access
- S3 Bucket – Enable S3 Bucket Versioning
- S3 Bucket – Enable S3 Bucket Encryption
- RDS DB Instance – Enable Auto Minor Version Upgrade
- RDS DB Instance – Block Public Access
- RDS DB Instance – Monitor Free Storage Space
- RDS DB Instance – Monitor CPU Utilization
- RDS DB Instance – Encryption of Storage
- RDS DB Instance – Enable Deletion Protection
- SQS Queue – Monitor Message Visibility
- DynamoDB Table – Enable Table Encryption
- DynamoDB Table – Enable Table Point In Time Recovery
- DynamoDB Table – Enable Table Deletion Protection
- DynamoDB Table – Monitor Table Read Capacity
- DynamoDB Table – Monitor Table Write Capacity
- DynamoDB Table – Monitor Table Latency
- Enable User MFA
- Enforce Key Rotation
- Enforce Active Key Limit
- Disable Unused User Credentials
- Enforce Group Permission
- Enable CloudTrail
- Enable AWS Security Hub
- Enforce Password Length
- Prohibit Password Reuse
- Purge Expired Certificates
- Check Root Access Keys Existence
- Enable Root MFA
- Establish Support Role
- Enable Key Rotation
- Encrypt CloudTrail Logs
- Enable GuardDuty
SQS Queue – Monitor Message Age
This check ensures that the age of messages in Amazon SQS queues is monitored. Monitoring message age helps identify processing delays and prevents messages from remaining unprocessed for extended periods.
Check Details
- Resource: SQS Queue
- Check: Monitor SQS message age
- Risk: Delayed processing or message loss due to long retention periods
Remediation via AWS Console
-
Log in to the AWS Management Console and open the
Amazon SQS console.
-
Click Queues and select the required SQS queue.
-
Open the Monitoring tab and verify that the metric
ApproximateAgeOfOldestMessage is available and updating.
- If the metric is not present or messages are retained too long, click Edit.
-
Under Details, configure the
Message retention period to
4 days (345600 seconds) or higher.
- Click Save changes.
- Repeat these steps for all SQS queues.
Remediation via AWS CLI
-
Log in to the AWS Management Console and click the
CloudShell icon (
>_) in the top-right corner.
-
List all SQS queues:
aws sqs list-queues -
Verify queue attributes:
aws sqs get-queue-attributes \ --queue-url <queue-url> \ --attribute-names All
-
Set the message retention period to 4 days:
aws sqs set-queue-attributes \ --queue-url <queue-url> \ --attributes MessageRetentionPeriod=345600