| CloudWatch logs / KMS / maintenance window / VPC placement / minor-version upgrade | AWS control plane | Out of scope | Full surface | these AWS-managed settings are omitted. Configure logging, monitoring, encryption at rest and upgrades with the target cluster’s tools |
| Management API + UI | Admin | Supported | Most usage | the RabbitMQ management plugin is enabled (the same HTTP API Amazon MQ exposes on 443/15671); the management console URL differs from Amazon MQ’s |
| Plugins (Shovel / Federation / Consistent-Hash / Prometheus / OAuth2) | Admin | Supported | Most usage | because you operate the broker, you can enable any RabbitMQ plugin, a wider set than Amazon MQ’s curated list (Management, dynamic Shovel, Federation, Consistent-Hash-Exchange, OAuth2, LDAP, Prometheus). Amazon MQ’s private-broker Shovel/Federation restriction does not apply on the target cluster |
| Consumer acks / QoS prefetch | Delivery | Supported | Most usage | RabbitMQ handles acknowledgements and prefetch directly; consumer_timeout sets the delivery acknowledgement timeout |
| Dead-letter exchanges / TTL | Delivery | Supported | Most usage | native RabbitMQ dead-letter exchanges and message/queue TTL |
| Publisher confirms | Delivery | Supported | Most usage | native RabbitMQ publisher confirms |
| Transactions (Tx.Select / Tx.Commit / Tx.Rollback) | Delivery | Supported | Full surface | native AMQP 0-9-1 transactions on the same broker engine; publisher confirms are the recommended higher-throughput path |
| ActiveMQ engine | Engine | Out of scope | Full surface | Amazon MQ’s ActiveMQ engine is a different protocol and is out of scope; only RabbitMQ is supported |
| Bindings + routing keys | Messaging | Supported | Common | native RabbitMQ routing, unchanged |
| Exchanges (direct / fanout / topic / headers) | Messaging | Supported | Common | native RabbitMQ; every exchange type works unchanged |
| Queues (classic / quorum / lazy) | Messaging | Supported | Common | RabbitMQ quorum queues replicate across the 3-node cluster for high availability |
| Streams (RabbitMQ 3.9+) | Messaging | Supported | Full surface | The target supports RabbitMQ Streams as an optional feature beyond the Amazon MQ queue mapping. Core streams can use AMQP; the dedicated Stream protocol needs its plugin, listener and compatible client. Configure and validate Streams separately. |
| Authentication (authentication_strategy=SIMPLE) | Security | Supported | Most usage | SIMPLE is the default strategy. The broker’s declared user block (username/password) is written into a Kubernetes secret, and RabbitMQ’s internal user backend authenticates against it unchanged |
| LDAP authentication | Security | Partial | Full surface | RabbitMQ’s LDAP auth-backend plugin (rabbitmq_auth_backend_ldap) is available on the self-operated broker; enable it and point it at your directory. Configure the LDAP server connection on RabbitMQ directly |
| TLS | Security | Supported | Most usage | TLS is on (Amazon MQ RabbitMQ is always-TLS); the certificate is self-signed or cert-manager-issued rather than AWS-managed, so the trust chain differs. Pin or trust the cluster’s issuer |
| Connect (AMQP 0-9-1) | Wire protocol | Supported | Common | your AMQP client (pika, amqplib, the RabbitMQ Java client) connects without changes. Bitnami RabbitMQ runs the same broker engine as Amazon MQ, so the protocol is native; Tensor9 writes the target broker endpoint into the generated Amazon MQ resource outputs |