A Broker whose Maintenance Is Not an Outage

aws-mq

An Amazon MQ broker that survives losing an availability zone, records who connected to it, and does not put your message bus on the internet. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

deployment_mode defaults to SINGLE_INSTANCE, and that is not only a durability question. Amazon MQ reboots the instance to apply maintenance, so a single-instance broker has planned downtime on AWS's schedule and every producer and consumer has to survive it. Active/standby across two AZs here, with survives_losing_an_az as an output.

Both log streams are off by default. The general log is the broker's own record; the audit log is who connected and what they did through the management interface. Off means an unexplained message loss has nothing to look at.

Passwords are a separate variable from users, and that is not tidiness. The user block's password is sensitive, and Terraform refuses a sensitive value as a for_each argument - so one map holding both users and passwords cannot be iterated at all. users carries the plain facts and is what gets iterated; user_passwords is sensitive and is looked up by the same key. Both end up in state, so the state backend needs to be encrypted regardless.

The audit log, console access, multi-user creation and the multi-AZ value are all engine-specific. RabbitMQ has no audit log, ignores console_access, accepts exactly one user at creation, and uses CLUSTER_MULTI_AZ rather than ACTIVE_STANDBY_MULTI_AZ. The API accepts several of those mismatches and then does nothing with them, so preconditions refuse the combination and name the value to set instead. The defaults are ActiveMQ, because that is the engine where every one of those settings exists.

Smaller things: auto_minor_version_upgrade is on, because minor versions are where the broker's security patches ship; a precondition refuses publicly_accessible unless accept_public_broker says it was meant; and kms_key_arn and use_aws_owned_key are mutually exclusive at the API, so passing a key is what turns the AWS-owned key off.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.