The idea that SNS isn't first-in, first-out is scary enough to me - but the fact that it's also "at least one copy will be delivered" (rather than "only one copy") makes it kind of insane.

Yes, please. Let me know and I'll make sure that the team sees it.

SNS is frequently a huge PITA to get working, often requiring SSH tunnels and the like.

Not sure I follow. Could you elaborate how SNS would require an SSH tunnel to work? I've never encountered this issue in environments I have worked in.

I looked into this and I was actually mistaken - I was referencing SES, not SNS. Apologies!