Description

Ensure that every Amazon SNS topic has server-side encryption enabled with an AWS KMS key. A topic is considered unencrypted when no KMS key is configured for it.

Rationale

Without server-side encryption, SNS stores the bodies of published messages without KMS encryption while they are being delivered, which weakens their confidentiality. Privileged insiders or compromised components could access message contents in plaintext. Encrypting topics with AWS KMS, preferably with a customer managed key, adds key policies, rotation and CloudTrail audit records for key use. Sensitive data in messages should also be kept to a minimum.

Impact

  • Protects message contents at rest with KMS encryption and audit records of key use

  • AWS services that publish to the topic (for example, Amazon CloudWatch alarms, Amazon EventBridge or Amazon S3 event notifications) need permission to use the key; this requires a customer managed key, because the policy of the AWS managed key aws/sns cannot be changed

  • KMS requests add cost

Default Value

Server-side encryption is not enabled on new SNS topics by default.

Pre-Requisites

  • IAM permissions: sns:ListTopics, sns:GetTopicAttributes and sns:SetTopicAttributes

  • If a customer managed key is used: a key policy that allows the topic's publishers, including any AWS service principals, to use kms:GenerateDataKey* and kms:Decrypt

  • A list of the publishers of each topic, to confirm they can still publish after encryption is enabled

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon SNS console and select Topics.

  3. Select a topic and open the Encryption tab.

  4. Check that encryption is enabled and a KMS key is shown.

  5. Repeat for each topic in each region in use.

  6. If encryption is disabled for any topic, follow the implementation steps.

CLI:

List the topics in a region:

aws sns list-topics --region <REGION> --query "Topics[].TopicArn" --output table

Show the attributes of a topic, including KmsMasterKeyId:

aws sns get-topic-attributes --region <REGION> --topic-arn <TOPIC_ARN>

A topic fails if the KmsMasterKeyId attribute is missing or empty.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon SNS console and select Topics.

  3. Select the topic and choose Edit.

  4. Expand Encryption and select Enable encryption.

  5. Choose the AWS managed key (alias/aws/sns), or a customer managed key if AWS services publish to the topic.

  6. Choose Save changes.

  7. Repeat for each affected topic in each region in use.

CLI:

Enable encryption with the AWS managed key (use a customer managed key ARN instead if AWS services publish to the topic):

aws sns set-topic-attributes --region <REGION> --topic-arn <TOPIC_ARN> --attribute-name KmsMasterKeyId --attribute-value alias/aws/sns

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon SNS console and select Topics.

  3. Select the topic and choose Edit.

  4. Expand Encryption and select Disable encryption, or choose a different KMS key if publishers cannot use the current one.

  5. Choose Save changes.

Note: disabling encryption removes KMS protection from the topic's messages. Prefer fixing the key policy so publishers can use the key.

Reference