worker services: enable `ChangeMessageVisibility` for SQS queues

[huanjani]

"To prevent other consumers from processing the message again, Amazon SQS sets a visibility timeout, a period of time during which Amazon SQS prevents other consumers from receiving and processing the message. The default visibility timeout for a message is 30 seconds. The minimum is 0 seconds. The maximum is 12 hours."

Users may want to change this default setting.

Ref:
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-visibility-timeout.html
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ChangeMessageVisibility.html

[nandubatchu]

Before this change is picked-up - what is the current work-around?

[Lou1415926]

@nandubatchu Hi! I know you've contacted on Gitter, but I'm replying here as well for visibility (and folks with the same question can see).

My original reply on Gitter:

Unfortunately, as of now you might need to change that configuration either through console or aws cli - there isn't a good workaround that stays within Copilot : (

In the future, Copilot might provide more generic way to override configurations like this that are not surfaced in the manifest, for example, with #4209. As of now, there is no great workaround to do this.

Sorry for the trouble! This thread will be updated once we surface "visibility_timeout" in manifest and let you know.

[nandubatchu]

@Lou1415926 - for the time being I am handling the visibility timeout of an individual message from the worker service code calling ChangeMessageVisibility API with a timer - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ChangeMessageVisibility.html

[gabrieljoelc]

@nandubatchu how do you have permissions to use ChangeMessageVisibility from the worker service code? I tried doing the same but got an Access to the resource https://sqs.us-east-2.amazonaws.com/ is denied, which makes sense because the worker service queue permissions lack the ChangeMessageVisibility the permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111111:role/myapp-dev-myworkerservice-TaskRole-7777777777777"
      },
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage"
      ],
      "Resource": "arn:aws:sqs:us-east-2:111111111111111:myapp-dev-myworkerservice-EventsQueue-4444444444"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-2:111111111111111:myapp-dev-myworkerservice-EventsQueue-44444444444",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:sns:us-east-2:111111111111111:myapp-dev-mypublisherservice-mytopic"
        }
      }
    }
  ]
}

[efekarakus]

Hi @gabrieljoelc !

I'm not sure how @nandubatchu achieved it but you can do that now by updating the QueuePolicy resource using YAML patch overrides: https://aws.github.io/copilot-cli/docs/developing/overrides/yamlpatch/