Description
SQS server-side encryption (SSE) protects stored message bodies. New queues have SSE enabled by default, so omitting a KMS key does not by itself disable encryption.
Potential impact
Explicitly disabling queue SSE removes an additional layer of message protection and may violate organizational data-protection requirements.
Remediation
Use SSE-SQS with sqs_managed_sse_enabled = true, or configure SSE-KMS with kms_master_key_id. When using KMS, grant message producers and consumers the necessary key permissions.
Examples
The first example explicitly disables SSE-SQS; the second uses SSE-KMS with the AWS managed SQS key.
Before
hcl
resource "aws_sqs_queue" "example" {
name = "terraform-example-queue"
sqs_managed_sse_enabled = false
kms_data_key_reuse_period_seconds = 300
}
After
hcl
resource "aws_sqs_queue" "example" {
name = "terraform-example-queue"
kms_master_key_id = "alias/aws/sqs"
kms_data_key_reuse_period_seconds = 300
}