Description:

This check ensures that all Amazon SQS queues are configured to use AWS Key Management Service (AWS KMS) with a customer-managed KMS key for Server-Side Encryption (SSE-KMS). Using a customer-managed KMS key encrypts messages at rest while providing greater control over key management, access permissions, auditing, and compliance.


Rationale:

Amazon SQS queues may contain sensitive information such as application events, customer data, financial transactions, credentials, or system logs. Encrypting messages using a customer-managed AWS KMS key protects data at rest while allowing organizations to manage the encryption key lifecycle, enforce granular access control, monitor key usage through AWS CloudTrail, and meet security and regulatory compliance requirements


Impact:

  • Encrypts messages at rest.

  • Provides centralized key management and access control.

  • Supports compliance requirements.

  • Requires applications to have appropriate AWS KMS permissions.

  • May incur AWS KMS charges.


Default Value:

By default, Amazon SQS queues use Amazon SQS-managed encryption (SSE-SQS) 


Pre-requisites:

  • A customer-managed AWS KMS key exists in the same AWS Region as the SQS queue.

  • Required IAM users, roles, and applications have permission to use the KMS key.

  • The KMS key policy allows Amazon SQS and authorized principals to use the key.


Test Plan:

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon SQS.

  3. Select the SQS queue to review.

  4. In the detail section, you can see the  Encryption.

  5. Verify that:

    • Server-Side Encryption is enabled.

    • AWS Key Management Service (SSE-KMS) is selected as the encryption method.

  1. If AWS Key Management Service (SSE-KMS) is not selected as the encryption method, follow the Implementation Steps.


Implementation Step:

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon SQS.

  3. Select the queue that requires configuration.

  4. Select Encryption, then click on Edit.

  1. In the Encryption section, verify that Server-Side Encryption is enabled. If Server-Side Encryption is disabled, enable it.

  2. Select AWS Key Management Service (SSE-KMS) as the encryption method.

  3. Select the organization's approved customer-managed AWS KMS key.

  1. Save the changes.


Backout Plan:

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon SQS.

  3. Select the affected queue and choose Edit.

  4. Restore the queue's previous encryption configuration in accordance with your organization's change management process.

  5. Save the changes.


References: