Test: Messaging Queue Message Age Monitored

ASSOCIATED DRATA CONTROL

This test is part of the Messaging Queues Monitored and Alarmed control that ensures your company has implemented tools to monitor messaging queues and notify appropriate personnel of any events or incidents based on predetermined criteria.

WHAT TO DO IF A TEST FAILS

If Drata detects that messaging queue message age monitoring is not enabled or that alerts have not been properly set up the test will fail. With a failed test you will receive a list of queues that lack message age monitoring or administrative alerts.

To remediate a failed test, you will need to set up and configure message age monitoring for the reported queues to ensure they are monitored with alerts being sent to infrastructure admins in an event or incident.

STEPS FOR PASSING

To ensure a validated state when testing for monitoring the age of messages in the messaging queue, please follow the steps listed in the table below. Once the provider steps have been completed, navigate back to Drata and execute the test.

NOTE: If you are using the Datadog integration for this test, please see this help article for the metrics to be used.

Provider / Technology	Provider Steps
AWS - SQS	Within AWS, go to Amazon Cloudwatch Click the Create Alarm button Select metrics: SQS Click the next button Click Queue metrics Select the Metric name (ApproximateAgeOfOldestMessage) Click the select metric button Specify metric condition: - Conditions:  threshold: Static Greater than 10000 10000 is an illustrative example; choose a value that makes sense for your setup Click the next button. Configure Action: send notification Click the next button Add name and description of the alarm Click Next button Click the Create Alarm button Subscription Confirmation The subscription to the SNS topic used (or newly created) above must be confirmed for the test to pass. Go to SNS and select Subscriptions Click "Create subscription" and reference the newly created topic for the Topic ARN For Protocol select Email For Endpoint enter an email address, generally a monitored team inbox Click "Create subscription" and verify the email that was sent to your provided inbox Alternatively: Go to SNS and select Topics Click the topic name created with the alarm Under the Subscriptions banner, click the radio button for the topic's subscription Click "Confirm subscription" and verify the email that was sent to your provided inbox
GCP - PubSub	Within GCP, establish a topic in PubSub In monitoring, establish an alert policy Resource is Cloud Pub/Sub topic By default the GCP Alert UI may only show "Active" metrics, and you may need to turn that toggle off to see the required option Metric is Oldest Retained Acked Message by Region Select an active notification channel (any except mobile cloud console)