Description

Ensure that Lambda functions invoked asynchronously have a Dead Letter Queue (DLQ), using either an SQS queue or an SNS topic, configured to capture events that fail all processing retry attempts.

Rationale

Without a configured DLQ, an asynchronously invoked Lambda function that repeatedly fails to process an event (for example, due to a code bug or a downstream outage) will silently discard that event once Lambda's built-in retry attempts are exhausted, resulting in permanent, unnoticed data or event loss. Configuring a DLQ ensures failed events are captured for later inspection, reprocessing, or alerting, rather than being lost.

Impact

  • Prevents silent loss of asynchronous invocation events after retries are exhausted

  • Enables later inspection, reprocessing, or alerting on failed events

  • Requires operational processes to periodically review and act on the DLQ contents

Default Value

No Dead Letter Queue is configured by default for a newly created Lambda function; failed asynchronous invocations are discarded after retries are exhausted unless a DLQ or Lambda Destinations on-failure target is configured.

Pre-Requisites

  • An SQS queue or SNS topic to serve as the Dead Letter Queue destination

  • IAM permissions on the Lambda execution role to send messages to the DLQ destination (sqs:SendMessage or sns:Publish)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Lambda and select the function to review.

  3. Open the Configuration tab, then Asynchronous invocation.

  4. Verify that a Dead-letter queue service (SQS or SNS) and destination are configured, or that an on-failure Lambda Destination is configured as an alternative.

  5. If no DLQ or failure destination is configured for a function that is invoked asynchronously, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon SQS (or SNS) and create a queue or topic to serve as the Dead Letter Queue, if one does not already exist.

  3. Navigate to AWS Lambda and select the function to update.

  4. Open the Configuration tab, then Asynchronous invocation, and select Edit.

  5. Under Dead-letter queue, select the SQS queue or SNS topic created above.

  6. Ensure the function's execution role has permission to send messages to the selected destination.

  7. Save the configuration and test by forcing a failure to confirm the failed event appears in the DLQ.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Lambda and select the affected function.

  3. Open the Configuration tab, then Asynchronous invocation, and select Edit.

  4. Remove the Dead-letter queue configuration.

  5. Save the configuration.

Reference