<  Back to rules search

SQS Queue has server-side encryption

sqs

Classification:

compliance

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

Secure your Amazon Simple Queue Service (SQS) messages with server-side encryption.

Rationale

Encryption ensures that Amazon SQS messages, which may contain sensitive data, are not available to anonymous or unauthorized users.

Remediation

Console

Follow the Configuring service-side encryption for a queue(console) docs to learn how to create and use AWS Key Management Service (AWS KMS) to manage customer master keys (CMK) for server-side encryption.

CLI

  1. Define set-queue-attributes in a file. Use your custom KMS Master Key ARN for KmsMasterKeyID. Save the file.

    set-queue-attributes.json

        {
          "KmsMasterKeyId": "custom_key_arn",
          "KmsDataKeyReusePeriodSeconds": "300"
        }
        
  2. Run set-queue-attributes with the queue URL and the file created in step 1.

    set-queue-attributes.sh

        aws sqs set-queue-attributes
          --queue-url https://us-west-2.queue.amazonaws.com/123456789012/WebWorkerSQSQueue
          --attributes file://sqs-sse-enabled.json