Message Queuing

2 posts

aws3 min readCurated summary

Amazon SQS turns 20: Two decades of reliable messaging at scale | Amazon Web Services

Amazon SQS has spent two decades helping distributed systems communicate asynchronously without tightly coupling services. While its core purpose remains unchanged—decoupling producers and consumers, buffering traffic, and isolating failures—its scale, security, integrations, and workload support have expanded significantly. Recent improvements also make SQS suitable for high-throughput, multi-tenant, and AI-driven architectures. ## SQS’s Core Role in Distributed Systems - Producers place messages in queues and continue processing without waiting for consumers. - Consumers process messages when they are ready, preventing slow or unavailable services from causing cascading failures. - Customers use SQS to: - Decouple application components - Absorb traffic bursts - Improve resilience when individual services fail - Coordinate independent services and AI agents ## Higher Throughput for FIFO Queues - High-throughput FIFO mode launched in 2021 at up to 3,000 transactions per second per API action. - Capacity increased progressively to: - 6,000 TPS in 2022 - 9,000 TPS in 2023 - 18,000 TPS later in 2023 - Up to 70,000 TPS per API action in select Regions - The FIFO in-flight message limit grew from 20,000 to 120,000 in 2024, enabling more concurrent processing. ## Stronger Security and Access Controls - SSE-SQS launched in 2021, providing server-side encryption with AWS-managed keys and eliminating customer key-management requirements. - Encryption became the default for newly created queues in 2022. - Attribute-based access control was introduced in 2022, allowing permissions to be based on queue tags rather than static resource policies. ## Improved Message Recovery and Integration - Dead-letter queue redrive became available in the SQS console in 2021. - SDK and CLI APIs—including `StartMessageMoveTask`, `CancelMessageMoveTask`, and `ListMessageMoveTasks`—followed in 2023. - FIFO queue redrive support was added later that year. - JSON protocol support reduced processing latency by up to 23% for 5 KB payloads while lowering client CPU and memory use. - SQS queues can connect directly to EventBridge Pipes, enabling routing to many AWS services without custom integration code. ## Larger Messages and Fairer Queuing - The Extended Client Library for Python allows payloads up to 2 GB by storing message data in Amazon S3 and sending a reference through SQS. - In 2025, the native maximum message size increased from 256 KiB to 1 MiB for standard and FIFO queues. - Fair queues help prevent one tenant in a shared standard queue from delaying others. Producers provide a message group ID, while consumers require no changes. ## SQS for AI Workloads - SQS can buffer requests to large language models and regulate inference throughput. - Queues also help coordinate autonomous AI agents that operate as separate services. - These use cases apply the same established messaging model to more complex, distributed AI systems. Amazon SQS’s recommendation remains straightforward: use asynchronous queues when systems need loose coupling, burst management, and resilience. Its newer throughput, security, recovery, integration, and fairness features extend that pattern to larger and more demanding applications.

Read original(opens in new tab)
datadog3 min readCurated summary

How we use formal modeling, lightweight simulations, and chaos testing to design reliable distributed systems

Courier’s design illustrates why distributed systems need more than unit, integration, and chaos testing. Datadog combined formal modeling, lightweight simulation, and conventional testing to uncover system-level risks before implementation. The approach was especially important after the March 8, 2023 outage, which showed how locally reasonable decisions can produce severe global failures. ## Why Distributed Systems Require Additional Analysis - Distributed systems provide greater scale and availability, but introduce concurrency, coordination, and failure modes that are difficult to reason about intuitively. - Traditional tests operate at relatively low levels of detail and may miss high-level design flaws. - Formal models and simulations allow teams to evaluate system behavior during the design phase, before implementation choices become expensive to change. - Model checking exhaustively explores all states permitted by a design and verifies defined correctness properties. ## Formal Modeling and Lightweight Simulation - Formal modeling uses a high-level specification language to describe: - System components and their interactions - Allowed system states - Properties the system must satisfy - Lightweight simulation builds a replica that runs under controlled conditions to study statistical characteristics such as: - Latency - Cost - Scalability - Behavior under realistic workloads - Modeling verifies correctness but cannot fully assess performance-related concerns. - Neither technique validates the final implementation directly. - Keeping models and simulations synchronized with the production design adds maintenance overhead. - Datadog considered the additional effort worthwhile because Courier was foundational, needed strong reliability guarantees, and incorporated lessons from the 2023 outage. ## Courier’s Requirements Courier was created to replace a decade-old Redis-backed queuing system that had begun to face throughput, scaling, and durability limitations. Its main requirements were: - **Multi-tenancy:** Isolate teams and products so one tenant cannot significantly disrupt others. - **At-least-once delivery:** Messages must not be lost; they must be delivered and acknowledged or sent to a dead-letter queue. - **Graceful degradation and high availability:** Throughput should decline roughly linearly as compute capacity is lost, rather than collapsing entirely. - **Horizontal scalability:** Throughput should increase linearly as compute capacity is added. The graceful-degradation requirement directly addressed the March 8 outage, when lost compute capacity caused a disproportionate throughput failure. ## FoundationDB Sharding for Tenant Isolation - Courier uses multiple FoundationDB clusters. - Each tenant is assigned to a subset of clusters. - No two tenants share the exact same cluster subset. - The initial design used: - Eight FoundationDB clusters - Four clusters per tenant - A theoretical maximum of `8 choose 4 = 70` tenant assignments - If one tenant saturated or disabled its four clusters, other tenants would still retain access to at least 25% of the total cluster capacity. - This arrangement provided sufficient isolation for the intended workloads. ## Broker Layer and High Availability - A broker layer exposes gRPC APIs for: - Sending messages - Receiving messages - Deleting messages - Clients connect only to the brokers, which apply the tenant-sharding logic. - Brokers health-check FoundationDB clusters and remove unhealthy clusters from consideration. - Both brokers and FoundationDB clusters are deployed across three availability zones to improve resilience. Courier demonstrates that formal verification and simulation are valuable complements to implementation testing. For mission-critical distributed services, teams should validate both correctness and operational behavior early, while also using unit, integration, and chaos testing to verify the final system.

Read original(opens in new tab)