# Ensure SNS Topics Are Encrypted

- Source: https://support.icompaas.com/support/solutions/articles/62000233557-ensure-sns-topics-are-encrypted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability**

-   **Level 2**

#### **Description**

Amazon SNS supports server-side encryption (SSE) to protect the contents of messages using AWS Key Management Service (KMS). Enabling encryption ensures that sensitive data is protected at rest, meeting security and compliance requirements. Unencrypted SNS topics may expose sensitive information to unauthorized access.

#### Rationale

-   Enhanced Security: Protects sensitive data stored in SNS topics from unauthorized access.
    
-   Compliance: Meets regulatory requirements for data encryption and privacy.
    
-   Risk Mitigation: Reduces the risk of data breaches and unauthorized access.
    

#### **Impact**

**Pros:**

-   Safeguards sensitive data in SNS topics.
    
-   Aligns with compliance and security best practices.
    
-   Provides centralized key management using AWS KMS.
    

**Cons:**

-   Requires additional configuration to enable encryption.
    
-   May incur costs for using AWS KMS.
    

#### **Default Value**

By default, SNS topics are not encrypted. Encryption must be explicitly enabled.

#### **Pre-Requisite**

IAM Permissions:

-   sns:ListTopics
    
-   sns:GetTopicAttributes
    
-   sns:SetTopicAttributes
    
-   AWS CLI installed and configured.
    

#### **Remediation**

**Test Plan: Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the SNS Dashboard.
    
3.  Select Topics from the left-hand menu.
    
4.  For each topic, check the Encryption section under the topic's attributes. Verify if encryption is enabled.
    

**Using AWS CLI:**

1.  List All SNS Topics:  
    
    aws sns list-topics --query "Topics\[\*\].TopicArn"
    
2.  Check Encryption Status for Each Topic:  
    
    aws sns get-topic-attributes --topic-arn <topic-arn> --query "Attributes.KmsMasterKeyId"
    
      
    

**Implementation Steps:**

 **Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the SNS Topics.  
    ![](https://support.icompaas.com/assets/kb/779f465930af4b72.png)![](https://support.icompaas.com/assets/kb/bebd9578b3bafca2.png)
    
3.  Select the topic to update.![](https://support.icompaas.com/assets/kb/98f43667fcf1e75f.png)
    
4.  Click Edit and expand the Encryption section.
    
5.  Enable encryption by selecting an AWS-managed key or a Customer Managed Key (CMK) from AWS KMS.![](https://support.icompaas.com/assets/kb/69a5f36e3adf4e47.png)
    
6.  Save the changes.
    

**Using AWS CLI:**

1.  Enable Encryption for a Topic:  
    
    aws sns set-topic-attributes --topic-arn <topic-arn> --attribute-name KmsMasterKeyId --attribute-value <kms-key-id>
    
2.  Verify the Changes:  
    
    aws sns get-topic-attributes --topic-arn <topic-arn> --query "Attributes.KmsMasterKeyId"
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If enabling encryption causes issues with topic publishing or subscriptions, you can disable encryption.![](https://support.icompaas.com/assets/kb/2b30b732e4054cdd.png)![](https://support.icompaas.com/assets/kb/ea0f867babe9d01d.png)![](https://support.icompaas.com/assets/kb/3f2ead875d324f7d.png) 
    
2.  #### Navigate to Amazon SNS in the AWS Management Console, select the topic, and under the Encryption section, choose Disable Encryption.![](https://support.icompaas.com/assets/kb/138cc6676af198b6.png)
    
3.  #### Save your changes and verify that the topic is no longer encrypted.  
    

#### **Using AWS CLI:**

1.  #### To disable encryption, use the following command:  
    
    aws sns set-topic-attributes --topic-arn <TOPIC\_ARN> --attribute-name KmsMasterKeyId --attribute-value "" --region <REGION>
    
2.  #### Verify that encryption has been disabled:  
    
    aws sns get-topic-attributes --topic-arn <TOPIC\_ARN> --region <REGION>
    

#### **References**

-   [Setting Up SNS Topic Encryption](https://docs.aws.amazon.com/sns/latest/dg/sns-enable-encryption-for-topic.html)
    
-   [Securing SNS Data with Server-Side Encryption](https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html)
    
-   [Amazon SNS Data Encryption Documentation](https://docs.aws.amazon.com/sns/latest/dg/sns-data-encryption.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.