# Ensure SNS topic is encrypted at rest with KMS

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292249383663-ensure-sns-topic-is-encrypted-at-rest-with-kms
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon SNS topic has server-side encryption enabled with an AWS KMS key. A topic is considered unencrypted when no KMS key is configured for it.

**Rationale**

Without server-side encryption, SNS stores the bodies of published messages without KMS encryption while they are being delivered, which weakens their confidentiality. Privileged insiders or compromised components could access message contents in plaintext. Encrypting topics with AWS KMS, preferably with a customer managed key, adds key policies, rotation and CloudTrail audit records for key use. Sensitive data in messages should also be kept to a minimum.

**Impact**

-   Protects message contents at rest with KMS encryption and audit records of key use
    
-   AWS services that publish to the topic (for example, Amazon CloudWatch alarms, Amazon EventBridge or Amazon S3 event notifications) need permission to use the key; this requires a customer managed key, because the policy of the AWS managed key aws/sns cannot be changed
    
-   KMS requests add cost
    

**Default Value**

Server-side encryption is not enabled on new SNS topics by default.

**Pre-Requisites**

-   IAM permissions: sns:ListTopics, sns:GetTopicAttributes and sns:SetTopicAttributes
    
-   If a customer managed key is used: a key policy that allows the topic's publishers, including any AWS service principals, to use kms:GenerateDataKey\* and kms:Decrypt
    
-   A list of the publishers of each topic, to confirm they can still publish after encryption is enabled
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon SNS console and select **Topics**.
    
3.  Select a topic and open the **Encryption** tab.
    
4.  Check that encryption is enabled and a KMS key is shown.
    
5.  Repeat for each topic in each region in use.
    
6.  If encryption is disabled for any topic, follow the implementation steps.
    

**CLI:**

List the topics in a region:

aws sns list-topics --region <REGION> --query "Topics\[\].TopicArn" --output table

Show the attributes of a topic, including KmsMasterKeyId:

aws sns get-topic-attributes --region <REGION> --topic-arn <TOPIC\_ARN>

A topic fails if the KmsMasterKeyId attribute is missing or empty.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon SNS console and select **Topics**.
    
3.  Select the topic and choose **Edit**.
    
4.  Expand **Encryption** and select **Enable encryption**.
    
5.  Choose the AWS managed key (alias/aws/sns), or a customer managed key if AWS services publish to the topic.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected topic in each region in use.
    

**CLI:**

Enable encryption with the AWS managed key (use a customer managed key ARN instead if AWS services publish to the topic):

aws sns set-topic-attributes --region <REGION> --topic-arn <TOPIC\_ARN> --attribute-name KmsMasterKeyId --attribute-value alias/aws/sns

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon SNS console and select **Topics**.
    
3.  Select the topic and choose **Edit**.
    
4.  Expand **Encryption** and select **Disable encryption**, or choose a different KMS key if publishers cannot use the current one.
    
5.  Choose **Save changes**.
    

Note: disabling encryption removes KMS protection from the topic's messages. Prefer fixing the key policy so publishers can use the key.

**Reference**

-   [https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html](https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html)
    
-   [https://docs.aws.amazon.com/sns/latest/dg/sns-key-management.html](https://docs.aws.amazon.com/sns/latest/dg/sns-key-management.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/sns/set-topic-attributes.html](https://docs.aws.amazon.com/cli/latest/reference/sns/set-topic-attributes.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.