AWS for Laravel teams: where complexity actually enters

Give the worker a narrowly scoped candidate policy

For the candidate worker below, ReceiveMessage obtains a delivery, DeleteMessage acknowledges it, and ChangeMessageVisibility changes its invisibility interval. GetQueueAttributes supports inspecting queue attributes, including queue size; it is not an acknowledgement. AWS documents all four actions against a queue ARN. The queue URL is assumed configured, so this fragment does not grant GetQueueUrl. A producer needs its own SendMessage permission.

This is an identity-policy allow statement for an example queue, not a complete role or proof of access. Replace the account, Region and queue name. Check the actual role trust relationship, applicable resource and endpoint policies, permissions boundaries and organization controls. An explicit deny can override an allow. A consumer of a customer-managed-KMS-encrypted queue also needs the relevant key access, including kms:Decrypt; the SQS statement alone does not provide it.

My recommendation is to keep provisioning permissions with the deployment identity and give the application only the operations it needs. Storage and database access are separate decisions. JSON parsing can check this fragment’s structure, but it cannot establish which permissions a deployed worker actually has.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ConsumeExportJobs",
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:ChangeMessageVisibility",
        "sqs:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:eu-west-1:123456789012:exports-test"
    }
  ]
}

A visibility interval does not make the effect unique

SQS standard queues provide at-least-once delivery. Receiving a message makes it temporarily invisible without deleting it; an unacknowledged message can become available again after the visibility timeout. AWS also warns that duplicate delivery can occur during that interval. A longer timeout therefore does not replace application duplicate handling, and an unnecessarily long one delays retry after a dead worker.

Laravel 12 documents SQS visibility configuration separately from the retry_after setting used by other drivers. In the tagged Laravel 12.69.3 SqsJob source, release changes message visibility and delete sends DeleteMessage with the delivery’s receipt handle. These are source-reviewed mechanisms, not calls executed by the local model.

The same version’s ordinary Job::fail path calls deletion before its failure callback and dispatches JobFailed in a finally block. With SqsJob, that deletion attempts the SQS API call. API errors and abrupt process termination can change the outcome. Do not assume every job in Laravel failed-job storage is also waiting in an SQS dead-letter queue. SQS redrive uses its configured receive-count policy; it is a separate recovery mechanism.

Inspect the persisted state after a real worker exit

The local model uses export-cedar-17 as a stable export identity and fingerprints the fixed CSV payload. The object key derives from that export identity, not a delivery receipt. SQLite stores pending or complete status and a publication record keyed by export ID. Acknowledgements are separate SQLite rows so their ordering can be inspected; they are not real queue acknowledgements. I chose a fixed CSV because retrying a live database query could produce different bytes under the same export ID. This keeps replay identity inspectable while leaving snapshot selection to a real exporter.

In the first run, the worker writes and closes export-cedar-17.csv, then exits with code 23 before recording completion. The parent observes a pending export, the complete expected CSV bytes and no acknowledgement. It starts another worker with receipt-2. That worker verifies the existing bytes, records completion and one publication row, then acknowledges receipt-2. A further delivery reuses the result without changing its bytes or publication record.

In the second run, the worker commits completion and exits with code 24 before acknowledgement. The next worker sees a complete record and verifies the object before reusing it. The driver also deletes a completed object deliberately: a retry recreates the expected bytes while preserving the single publication record. Reusing the same export ID with different input is rejected before changing state.

Thirty assertions check these transitions across separate processes. Four actual source mutations acknowledge too early, put the receipt in the object key, trust completion without checking the file, or omit the payload-identity check. Each must fail its intended assertion after the expected preceding observations. An unrelated crash is not accepted as evidence that a defect was detected.

The publication count is an idempotent local database record. It does not prove a file was written only once or an external billable effect happened once. The driver deliberately requests another delivery; there is no simulated visibility clock or SQS receipt validation. Workers are sequential, and process exits do not test power-loss durability. This distinction matters before translating the model to a distributed exporter.

"""Sequential file/SQLite recovery model. This is not an SQS or S3 emulator."""
import hashlib
import json
import os
from pathlib import Path
import sqlite3
import sys


def initialize(folder):
    folder.mkdir()
    (folder / 'objects').mkdir()
    with sqlite3.connect(folder / 'state.sqlite') as db:
        db.executescript('''
            CREATE TABLE exports (id TEXT PRIMARY KEY, fingerprint TEXT, status TEXT);
            CREATE TABLE publications (export_id TEXT PRIMARY KEY);
            CREATE TABLE acknowledgements (receipt TEXT PRIMARY KEY);
        ''')


def handle(folder, payload, receipt, stop):
    export_id = 'export-cedar-17'  # Fixed synthetic identity, not arbitrary path input.
    fingerprint = hashlib.sha256(payload).hexdigest()
    path = folder / 'objects' / (export_id + '.csv')
    with sqlite3.connect(folder / 'state.sqlite') as db:
        stored = db.execute('SELECT fingerprint, status FROM exports WHERE id=?', (export_id,)).fetchone()
        if stored and stored[0] != fingerprint:
            raise ValueError('export ID reused with different payload')
        db.execute('INSERT OR IGNORE INTO exports VALUES (?, ?, ?)', (export_id, fingerprint, 'pending'))
        db.commit()
        if stored and stored[1] == 'complete' and path.is_file() and path.read_bytes() == payload:
            db.execute('INSERT INTO acknowledgements VALUES (?)', (receipt,))
            db.commit()
            return 'reused'
        if path.exists() and path.read_bytes() != payload:
            raise ValueError('stored object differs from expected bytes')
        if not path.exists():
            path.write_bytes(payload)
        if stop == 'after-object':
            os._exit(23)  # Real process exit; no claim about power loss or fsync.
        with db:
            db.execute('INSERT OR IGNORE INTO publications VALUES (?)', (export_id,))
            db.execute('UPDATE exports SET status=? WHERE id=?', ('complete', export_id))
        if stop == 'after-complete':
            os._exit(24)
        db.execute('INSERT INTO acknowledgements VALUES (?)', (receipt,))
        db.commit()
        return 'published'


if __name__ == '__main__':
    try:
        result = handle(Path(sys.argv[1]), bytes.fromhex(sys.argv[2]), sys.argv[3], sys.argv[4])
        print(json.dumps({'result': result}))
    except ValueError as error:
        print(json.dumps({'error': str(error)}))
        raise SystemExit(2)

Make the cloud integration prove what the model cannot

For a real export, define immutable input identity: saving the same export ID is insufficient if a retry reads a changed database snapshot. Choose a storage publication protocol that accounts for interrupted uploads and concurrent attempts. Test authorization when the user requests the download, and define retention and object-repair behavior. The local fixed-payload model implements none of those service boundaries.

Correct IAM permissions also do not establish network reachability. An SQS VPC endpoint provides a private connection path and can have its own endpoint policy. Check routing, DNS and authorization separately. Record useful service error codes without credentials or customer payloads. A worker that reaches SQS but cannot decrypt a message needs a different investigation from a connection timeout.

My recommendation is to cap worker concurrency against observed database and storage capacity, then test an export that loses its acknowledgement after publication in the actual environment. Inspect Laravel failures and SQS redrive separately. Include the chosen network path and retention costs in the operating plan; this article supplies no price estimate or throughput benchmark.

Download the complete model and run python3 frontend/content-quality/fixtures/aws-delivery/verify.py results.json from the extracted root. Docker and host Python are required. The runner uses a digest-pinned official Python image, has no network during execution and saves source hashes, state traces and deliberate-failure identities. Use that trace to specify the service integration test you still need, rather than treating the local pass as an AWS deployment approval.