Amazon MQ

What it is

Amazon MQ is a managed message broker service for Apache ActiveMQ Classic and RabbitMQ. AWS sets up the broker, patches it, upgrades it during a maintenance window you choose, and replaces failed hardware. Your applications keep using the same broker, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, and protocols they already use.

That is the reason to choose it. Many existing applications, often running On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry, talk to a broker through industry-standard APIs and protocols such as JMS, NMS, AMQP, MQTT, OpenWire, or STOMP. Moving them to Amazon SQS and SNS means rewriting their messaging code. Moving them to Amazon MQ means changing a connection string.

Engines and protocols

	Amazon MQ for ActiveMQ	Amazon MQ for RabbitMQ
Protocols	OpenWire, AMQP, MQTT, STOMP, and MQTT or STOMP over WebSocket	AMQP 0-9-1
Typical clients	Java applications using JMS, .NET applications using NMS, IoT devices using MQTT	Applications that already use RabbitMQ client libraries
HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry option	Active/standby pair across two AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry	Three-node cluster across Availability Zones
Storage	Amazon EFS (durability-optimized) or Amazon EBS (throughput-optimized)	Amazon EBS

All client connections use TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry.

Deployment modes

ActiveMQ

Single-instance broker: one broker in one Availability Zone. With Amazon EFS storage, the message data is stored redundantly across several Availability Zones; with Amazon EBS storage, it stays in one Availability Zone with lower LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry and higher throughput. If the broker fails, it is unavailable until it recovers. Use it for development and testing.
Active/standby broker: two brokers in two Availability Zones, sharing Amazon EFS storage. Only one is active at a time; if it fails or is under maintenance, the standby takes over. Clients use the FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry transport with both endpoints, so they reconnect to whichever broker is active. Use it for production.
Network of brokers: several brokers connected by network connectors, to spread load and increase availability, including across AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry. ActiveMQ also offers cross-Region data replication, which copies messages asynchronously to a replica broker in another Region that you can promote during a Regional outage.

RabbitMQ

Single-instance broker: one broker in one Availability Zone, behind a Network Load Balancer, so its endpoint stays the same when the instance is replaced.
Cluster deployment: three broker nodes in different Availability Zones behind a Network Load Balancer, sharing users, queues, and state. Queues are replicated across the nodes, and quorum queues keep delivering through a newly elected leader if one node is unavailable. Use it for production.

Security, resilience, performance, and cost

Security

Network access: a broker is created either with public accessibility or as a private broker that can be reached only from inside your VPC. AWS recommends private brokers. Use Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry to allow only the protocol ports you use, for example 61617 for OpenWire or 5671 for AMQP.
Who can connect: messaging clients authenticate to the broker itself, not with IAM. ActiveMQ supports native broker users or an LDAP (Lightweight Directory Access Protocol)A protocol for reading and updating a directory, such as the users and groups in Microsoft Active Directory. Applications use it to look up and authenticate users.Glossary entry directory, such as Microsoft Active Directory. Configure an authorization map to control which users can read or write which queues and topics, because by default any authenticated ActiveMQ user can do anything.
IAM controls the Amazon MQ API: creating, changing, rebooting, and deleting brokers.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry is always on, using an AWS KMS key owned by Amazon MQ (the default), the AWS managed key aws/mq, or a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry. Encryption in transitEncrypting data while it moves across a network, usually with TLS, so that it cannot be read or changed on the way.Glossary entry uses TLS for client connections.

Resilience

Choose active/standby (ActiveMQ) or a cluster (RabbitMQ) for production; single-instance brokers are a single point of failure.
Maintenance and reboots cause a failover in active/standby brokers, so clients must be able to reconnect automatically.
For Regional DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry, use ActiveMQ cross-Region data replication or a network of brokers across Regions.

Performance

Choose the broker instance type for the throughput you need; the broker does not scale automatically as SQS does.
For ActiveMQ, Amazon EBS storage gives lower latency and higher throughput; Amazon EFS gives higher durability across Availability Zones.
Spread load across a network of brokers (ActiveMQ), or use a cluster (RabbitMQ).

Cost

You pay for broker instance hours, by instance type and deployment mode, plus storage per GB-month and data transfer. Active/standby and clusters cost more than a single instance, because they run more brokers.
Unlike SQS and SNS, you pay while the broker runs, whether or not messages flow. For new applications with variable traffic, SQS and SNS are usually cheaper.

Monitoring

Amazon CloudWatch receives broker and destination metrics every minute. For ActiveMQ, watch CpuUtilization, HeapUsage, StorePercentUsage (storage used), and per-queue QueueSize (messages waiting).
CloudWatch Logs can receive an ActiveMQ broker's general log and its audit log of management actions.
AWS CloudTrail records Amazon MQ API calls.

Amazon MQ or SQS and SNS?

	Amazon MQ	Amazon SQS and SNS
Best for	Migrating existing applications that use a broker	New cloud applications
APIs and protocols	JMS, NMS, AMQP, MQTT, OpenWire, STOMP	AWS APIs and SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry
Scaling	You choose instance types and the deployment mode	Scale automatically, nearly without limit
Network	Runs in your VPC, or public	Public AWS endpoints, or interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry
Pricing	Per broker hour and storage	Per request

Reverse mindmap: when the question points here

Is it Amazon MQ?

Yes, when the question says
- Migrate an on-premises ActiveMQ or RabbitMQ broker leads to Amazon MQ
- Existing JMS application, without rewriting code leads to Amazon MQ for ActiveMQ
- Protocols such as AMQP, MQTT, OpenWire, or STOMP leads to Amazon MQ
Make it highly available
- ActiveMQ must survive an Availability Zone failure leads to Active/standby broker
- RabbitMQ must survive an Availability Zone failure leads to Three-node cluster
- Clients must reconnect after a failover leads to Failover transport URL
Secure it
- Reachable only from inside the VPC leads to Private broker
- Use corporate directory credentials leads to LDAP authentication
- Encrypt with your own key leads to Customer managed KMS key
No, when the question says
- New application, least operational overhead leads to Amazon SQS or Amazon SNS
- Scale automatically with no brokers to size leads to Amazon SQS
- Stream data with Apache Kafka leads to Amazon MSK

Key takeaways

Amazon MQ runs ActiveMQ and RabbitMQ brokers for you, so existing applications keep their APIs and protocols.
For new applications, SQS and SNS are simpler, scale automatically, and are usually cheaper.
Production brokers use active/standby across two Availability Zones (ActiveMQ) or a three-node cluster (RabbitMQ).
Prefer private brokers in your VPC, restrict ports with security groups, and configure an authorization map.
Encryption at rest is always on, with a choice of KMS key; clients connect over TLS.