How can I identify the sender of a shadow update that's been forwarded?

I set up a rule in my IoT service that examines shadow update requests coming in from my devices by monitoring the topic with the reserved name for shadow updates, namely, $aws/things/+/shadow/update. When it notices certain kinds of updates that we consider exceptional, the rule forwards the message to an SQS queue. We plan to have a server running on an EC2 instance that monitors this queue so it can take appropriate action.

The problem I'm having is that when the EC2 instance receives the message from the queue, all it gets is the JSON containing the desired state as requested by the device. But there is nothing in this message that includes the name or identity of the device that sent it. I need that information to take action.

One solution might be to have the device itself include its own name in the shadow state, but I don't really like this idea. Ideally, I'd like to somehow have the rule append the device name to the message (or just append the name of the topic which includes the device name). I don't see any obvious way for rules to send modified messages or append information this way. Is it a viable solution?

If not, what's the recommended approach?

Thanks, Frank