Process Amazon MQ messages with Lambda

Configure network access

To give Lambda full access to your broker through your event source mapping, either your broker must use a public endpoint (public IP address), or you must provide access to the Amazon VPC you created the broker in.

By default, when you create an Amazon MQ broker, the PubliclyAccessible flag is set to false. For your broker to receive a public IP address, you must set the PubliclyAccessible flag to true.

Best practice for using Amazon MQ with Lambda is to use Amazon PrivateLink VPC endpoints and to give your Lambda function access to your broker's VPC. Deploy an endpoint for Lambda, and, for ActiveMQ only, an endpoint for Amazon Security Token Service (Amazon STS). If your broker uses authentication, also deploy an endpoint for Amazon Secrets Manager. To learn more, see Set up Amazon VPC endpoints.

Alternatively, configure a NAT gateway on each public subnet in the VPC containing your Amazon MQ broker. For more information, see Enable internet access for VPC-connected Lambda functions.

When you create an event source mapping for an Amazon MQ broker, Lambda checks whether Elastic Network Interfaces (ENIs) are already present for the subnets and security groups of your broker’s VPC. If Lambda finds existing ENIs, it attempts to re-use them. Otherwise, Lambda creates new ENIs to connect to the event source and invoke your function.

Configure security group rules

Configure the security groups for the Amazon VPC containing your Amazon MQ.

Set up Amazon VPC endpoints

When you use Amazon VPC endpoints, Amazon routes your API calls to invoke a function using the endpoint's Elastic Network Interface (ENI). The Lambda service principal needs to call lambda:InvokeFunction on any functions that use those ENIs. Additionally, for Amazon MQ for ActiveMQ, the Lambda service principal must perform sts:AssumeRole on roles that use the ENIs.

By default, Amazon VPC endpoints have open IAM policies that allow broad access to resources. To use Amazon MQ with Lambda in production, you might restrict these policies to only allow specific principals to only access specifc roles and functions.

The following example VPC endpoint policies show how to grant the required access for Amazon STS and Lambda endpoints.

{
      "Statement": [
          {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                  "Service": [
                      "lambda.amazonaws.com"
                  ]
              },
              "Resource": "arn:aws-cn::iam::123456789012:role/my-role"
          }
      ]
  }

{
      "Statement": [
          {
              "Action": "lambda:InvokeFunction",
              "Effect": "Allow",
              "Principal": {
                  "Service": [
                      "lambda.amazonaws.com"
                  ]
              },
              "Resource": "arn:aws-cn::lambda:us-west-2:123456789012:function:my-function"
          }
      ]
  }

If your Amazon MQ broker uses authentication, you can also restrict the endpoint policy for the Secrets Manager endpoint. To call the Secrets Manager API, Lambda uses your function role, not the Lambda service principal. The following example shows a Secrets Manager endpoint policy.

{
      "Statement": [
          {
              "Action": "secretsmanager:GetSecretValue",
              "Effect": "Allow",
              "Principal": {
                  "AWS": [
                      "arn:aws-cn::iam::123456789012:role/my-role"
                  ]
              },
              "Resource": "arn:aws-cn::secretsmanager:us-west-2:123456789012:secret:my-secret"
          }
      ]
  }

Create the event source mapping

Create an event source mapping to tell Lambda to send records from an Amazon MQ broker to a Lambda function. You can create multiple event source mappings to process the same data with multiple functions, or to process items from multiple sources with a single function.

To configure your function to read from Amazon MQ, add the required permissions and create an MQ trigger in the Lambda console.

To read records from an Amazon MQ broker, your Lambda function needs the following permissions. You grant Lambda permission to interact with your Amazon MQ broker and its underlying resouces by adding permission statements to your function execution role:

Lambda supports the following options for Amazon MQ event sources:

To enable or disable the trigger (or delete it), choose the MQ trigger in the designer. To reconfigure the trigger, use the event source mapping API operations.