# Ensure SNS Topic is Encrypted at Rest with KMS

- Source: https://support.icompaas.com/support/solutions/articles/a_178889004854118-ensure-sns-topic-is-encrypted-at-rest-with-kms
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Amazon Simple Notification Service (SNS) topics have server-side encryption enabled using an AWS KMS key, so that messages stored by SNS at rest are encrypted.

**Rationale**

Without server-side encryption, messages published to an SNS topic are stored unencrypted at rest during the brief period they are held for delivery, which may not meet confidentiality requirements for topics carrying sensitive notifications, such as those containing personal data, security alerts, or business-sensitive event details. Enabling server-side encryption with a KMS key ensures message content is protected at rest.

**Impact**

-   Protects potentially sensitive message content at rest
    
-   Supports compliance requirements mandating encryption of data at rest
    
-   Requires that all publishers and subscribers (and any services polling associated SQS queues) have appropriate KMS key permissions to encrypt and decrypt messages
    

**Default Value**

SNS topics are not encrypted by default; server-side encryption with a KMS key must be explicitly enabled.

**Pre-Requisites**

-   An AWS KMS key with a key policy granting publishers, subscribers, and the SNS service the required permissions
    
-   IAM permissions to update topic attributes (sns:SetTopicAttributes)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon SNS > Topics and select the topic to review.
    
3.  Open the Encryption section of the topic's details.
    
4.  Verify that Encryption shows as Enabled with an associated KMS key.
    
5.  If encryption is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS KMS and create (or identify) a KMS key with a key policy granting the required publisher, subscriber, and SNS service permissions.
    
3.  Navigate to Amazon SNS > Topics and select the topic to update.
    
4.  Select Edit, then locate the Encryption section.
    
5.  Enable server-side encryption and select the KMS key created above.
    
6.  Save the changes and verify that publishers can still successfully publish messages and subscribers can still receive them.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon SNS > Topics and select the affected topic.
    
3.  Select Edit, then locate the Encryption section, and disable server-side encryption.
    
4.  Save the changes.
    

**Reference**

-   [https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html](https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.