Provision docs-rs / crates-io AWS SQS queue

[marcoieni]

This was discussed at the 2026 Rust All-Hands meeting (meeting notes: rust-lang/all-hands-2026#5)

What to do

Provision an AWS SQS FIFO event queue between crates.io and docs.rs.

Characteristics of the queue:

• Setup:
  • Producer: crates.io
  • Consumer: docs.rs
• We should have sqs ordering and it doesn’t matter if events arrive more than once because events are idempotent (you can build a crate twice, you can delete a crate twice).
• We don’t need sns because we only have one consumer of sqs.
• By default, the message on sqs expires after 1 week. Which should be fine.

Tasks:

• Provision the queue in the crates-io-staging and crates-io-prod AWS accounts.
• The docs-rs related part should be done in the docs-rs-staging and docs-rs-prod AWS accounts
• Grant crates.io producer permissions (suggested by AI, to be verified):
  • sqs:SendMessage
  • likely sqs:GetQueueAttributes / sqs:GetQueueUrl
• Grant docs.rs consumer permissions (suggested by AI, to be verified):
  • sqs:ReceiveMessage
  • sqs:DeleteMessage
  • sqs:ChangeMessageVisibility
  • sqs:GetQueueAttributes
  • likely sqs:GetQueueUrl
• Prefer an SQS resource policy for cross-account access, rather than requiring docs.rs to assume a role in the crates.io account (decided at the all hands).
• Expose queue URL/ARN/name in a way crates.io and docs.rs deployment can consume them for configuration.
• Add Datadog monitoring with both dashboard and alerts for queue health (we want to know if docs.rs is falling behind processing events):
  • Queue backlog size
  • oldest-message age
  • age of oldest message
  • DLQ message count, if a DLQ is added

Questions

For the crates-io and docs-rs teams: Do we need a DLQ? I guess no, for the first implementation, we can create a follow-up issue

Why we need this change

docs.rs doesn't want to rely anymore on the crates.io git index as the notification source for registry changes (see rust-lang/docs.rs#785).

docs.rs needs to be notified about the following:

• new releases
• yanks / unyanks
• crate deletes
• version deletes

Useful resources

We already have another sqs queue in place used by crates-io:

simpleinfra/terragrunt/modules/crates-io-logs/main.tf

Line 1 in 2af0b1b

resource "aws_sqs_queue" "cdn_log_event_queue" {

AI disclosure

I used GPT5.5 with the codex harness to generate the first draft of this issue. I reviewed its output and changed it where necessary.

[syphar]

@marcoieni I don't see the need for a DLQ for now, I assume retries and long enough message timeout will be good enough.

I'll try to adapt the consistency check so we can validate changes.