My Agents running on various environments/devices are going to drop periodic messages from public network. These messages will be processed by my AWS Lambda. The systems are asynchronous.
I am thinking of using SQS to feed the Lambda. Just that, SQS endpoint will be open to internet. How can I validate the messages posted on AWS SQS.
Most of the devices/agents pushing messages will be on customer VPN. So, establishing a private-vpn-link is a possible solution.
You shoudn't make an SQS queue public so that anyone without AWS credentials could use it. Its not a good practice.
A better option is to uses API gateway in front of your SQS queue:
This way you can make your API gateway endpoint public, control its throughput, limits, throttling, access using API keys, and more.
The API gateway would be integrated with your SQS queue which would allow you to trigger your lambda function.
With the use of API keys or lambda authorizes you will be able to control access of your devices/agents to the API gateway, and subsequently, to the SQS.
The Amazon SQS endpoint is on the Internet not in a VPC. There is no benefit to using a VPN connection, unless you wish to create a policy that only allows messages to be sent to the queue if they come via the VPN connection.
Your use-case might be better-suited for AWS IoT rather than Amazon SQS:
It is designed to handle large quantities of data some from various devices, with in-built rules for handling the messages.
If you're looking to minimise your messages traversing the public internet space the you have a few options that are available to you.
Firstly, as you mention you have devices that can connect via a VPN, if this is possible you can create a VPC endpoint for SQS using a custom domain name.
In your application by referring to the custom domain name or a private IP address from one of the ENIs it might be possible to actually interact through the VPC privately.
You could enhance your security checking by adding a proxy layer in front to validate the input to perform any checks against the content. Your application would pass to this validation layer, and then add to the queue if it passes.
One thing worth pointing out is even with VPN the traffic is traversing the internet, however it is encrypted in transit. The best line of security is combining HTTPS alongside private credentials (preferably as an IAM role) to reduce the chance of someone being able to add improper data to your queue.
