Why did my Lambda Amazon SQS trigger get deactivated?

3 minute read

I configured my AWS Lambda function to process messages in an Amazon Simple Queue Service (Amazon SQS) queue, but the SQS trigger isn't active.

Short description

You can use a Lambda function to process messages in an Amazon SQS queue. Event source mapping reads from an event source and invokes a Lambda function.

Lambda pollers constantly make the ReceiveMessage API call to the Amazon SQS queue. If the ReceiveMessage API call doesn't complete, then the AWS::Lambda::EventSourceMapping resource is deactivated.

Resolution

Verify Lambda function permissions

Make sure that your Lambda function execution role has permissions to the ChangeMessageVisibility, DeleteMessage, GetQueueAttributes, and ReceiveMessage API actions.

Verify AWS KMS permissions

If the Amazon SQS queue is configured with AWS Key Management Service (AWS KMS) SSE-KMS encryption, then make sure that:

The AWS KMS key exists.
The Lambda function execution role has permissions to the Encrypt, Decrypt, and GenerateDataKey API actions.
The AWS KMS key policy permissions are configured to allow events to send to Amazon SQS queues.

Note: Amazon SQS queues with SSE-KMS encryption can't invoke a Lambda function in a AWS cross-account.

Troubleshoot with CloudTrail

You can use AWS CloudTrail event history to look up data events and review error codes for troubleshooting.
Note: CloudTrail is turned on by default for your AWS account.

For an ongoing record of events in your AWS account, create a trail. The trail creates logs of API calls made on your account.
Note: You can also view the most recent event history in the CloudTrail console.

Complete the following steps:

1. Open the CloudTrail console.

2. In the navigation pane, choose Event history.

3. Follow the instructions to view, display, and filter CloudTrail events for your use case.

You can also download recorded event history as a file in CSV or JSON format.

Check for the CloudTrail event name LambdaESMDisabled. The event log contains the data event LambdaESMDisabled with more information on why the Amazon SQS trigger's isn't active.

For more information, see Using CloudTrail to troubleshoot deactivated Lambda event sources.

(Optional) Create CloudWatch alarms

You can create an Amazon CloudWatch alarm for Amazon SQS metrics to get notified on the number of messages received, sent, deleted, and so on. For example, you can use the Amazon SQS metric NumberOfMessagesReceived to get the number of recent messages returned. If the count is 0, then invoke a new Lambda function to check the status of the Amazon SQS trigger. If the Amazon SQS trigger is still deactivated, then use the new Lambda function to activate it.

For more information, see Available CloudWatch metrics for Amazon SQS.