At-most-once, at-least-once and exactly-once delivery

What it is

A producer sends, a broker stores, a consumer acknowledges. If the consumer acknowledges before processing, a crash loses the message (at most once). If it acknowledges after processing, a crash between the two causes redelivery (at least once). Exactly-once processing requires the consumer's side effect and its acknowledgement to be atomic, or the side effect to be idempotent with a deduplication key. The cited Amazon SQS documentation describes standard queues as providing at-least-once delivery, with the consumer responsible for handling duplicates.

Why it matters

Choosing "at most once" silently loses work; assuming "exactly once" from a broker's marketing produces duplicate emails, double charges or double counts under retries and rebalances.

How to apply

• Default to at-least-once delivery with idempotent consumers: store the message ID with the effect (unique constraint) and skip on conflict.
• Make side effects transactional with the deduplication record where possible (same database), or use the outbox pattern: write the event in the same transaction as the state change, publish from the outbox.
• Set acknowledgement deadlines longer than processing time; extend them for long jobs, or move long work to a separate queue.
• Route poison messages to a dead-letter queue after a bounded number of attempts and alert on it.

Pitfalls

Ordering guarantees usually hold only per key or partition. A consumer that is idempotent for one message can still be wrong for reordered messages. Deduplication windows in brokers are time-bounded.