DVA-C03 practice question: Messaging with SQS, SNS and EventBridge (1 of 2)
Development with AWS Services A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A shipping team in one AWS account subscribes its Amazon SQS standard queue to an Amazon SNS topic owned by the orders team in a different account.
The subscription exists and the orders team's publishes succeed, but the shipping queue never receives a message. The queue's access policy currently allows only the shipping account's own roles.
The orders team cannot change its topic, and the shipping team must keep its queue as a standard queue.
Which change fixes the problem?
Choose one answer.
AA. Add an IAM policy to the orders team's publishing role that allows sqs:SendMessage on the shipping queue's ARN.
BB. Add a queue policy statement that allows sqs:SendMessage only when aws:SourceArn equals the topic's ARN.
CC. Convert the queue to a FIFO queue with content-based deduplication turned on, so that SNS can deliver to it.
DD. Attach a dead-letter queue to the subscription, so that failed deliveries are kept in a separate queue for inspection.
Show the answer and explanation
Answer: B
A. Wrong: SNS delivers to the queue itself, not with the publisher's credentials, so the publisher's role does not decide whether delivery is allowed. The queue would still refuse the messages.
B. Right: Correct. The queue's access policy decides whether SNS may deliver to it. A statement limited by aws:SourceArn to the topic's ARN lets only that topic send messages to the queue.
C. Wrong: FIFO changes how messages are ordered and deduplicated, not who may send to the queue. The queue policy would still deny SNS, so nothing would arrive.
D. Wrong: A dead-letter queue collects messages that SNS could not deliver, which helps diagnosis. It does not grant the delivery, so the queue policy still has to allow SNS.
Explanation
When an SQS queue in one account is subscribed to a topic in another, the queue's access policy must allow sqs:SendMessage from SNS. Limiting the statement with aws:SourceArn to the topic's ARN allows only that topic. Changing the publisher's IAM role, the queue type or the subscription's dead-letter queue does not add this permission.
Want more on Messaging with SQS, SNS and EventBridge? The 5 full-length practice sets have 11 more Messaging with SQS, SNS and EventBridge questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →