A queue visibility lease hides a received message from other consumers for a bounded period. If processing continues after that period, the message can be delivered again while the first worker is still running. Extending visibility reduces overlap but can delay recovery when the worker is stuck. At-least-once delivery can also duplicate a message for other reasons, so lease management cannot replace effect idempotency.
Make this comfortable
Queue visibility leases: prevent overlapping workers on one message
Operational decision
A media worker transcodes a claims attachment, with normal jobs finishing in under ninety seconds and rare jobs taking several minutes. Start with a measured visibility duration, renew it only while the worker is making progress, and cap the total processing window. The text block is a worker contract, not a broker API call. Store the original attachment operation key alongside the output record, and make the final publish step conditional on that key not already being completed. Crash the worker immediately after publishing output but before acknowledging the message; the next delivery must observe the completed effect and acknowledge without publishing again. Then pause a worker long enough for its lease to expire and confirm overlapping deliveries cannot both commit. Track oldest visible age, in-flight count, renewal failures, and dead-letter arrivals. If the job is permanently invalid, move it to a reviewed failure path after a bounded attempt count rather than renewing forever.
Attachment worker lease
Measured normal duration: below 90 seconds
Visibility: 150 seconds to start
Renewal: only with observed progress; total cap 8 minutes
Effect key: original attachment operation ID
Publish: conditional on absent completed effect
Acknowledge: after durable output and completion recordCost and verification
A long lease reduces duplicate overlap but increases time before another worker can recover abandoned work. Frequent renewals add broker traffic and failure handling. An early acknowledgement improves throughput at the cost of lost work if the process fails before persisting output. Choose lease duration from actual processing distributions, keep the effect guard, and test both crash windows. A zero duplicate count in a short test does not establish exactly-once delivery.
Common Mistakes
- Do not let processing routinely outlive visibility without renewal.
- Do not acknowledge before the output is durable.
- Do not assign a new business key on redelivery.
Connected lessons
- DevOps: delivery, infrastructure, and reliable operations
- Queue consumers: acknowledgement, idempotency, and backlog
- Dead-letter replay: recover failed messages without repeating their effects
- Consumer rebalances: preserve ordering and effect ownership
- Retries and timeouts: bound the cost of a failed request
Practice and check
devops
operations