SNS topic is encrypted at rest with KMS

Check ID: sns_topics_kms_encryption_at_rest_enabled
Provider: AWS
Service: sns
Severity: HIGH
Categories: encryption
Resource type: AwsSnsTopic

What this check verifies

Amazon SNS topics are assessed for server-side encryption with AWS KMS. Topics lacking a configured KMS key (e.g., missing kms_master_key_id) are identified as unencrypted at rest.

Risk

Without KMS-backed SSE, SNS stores message bodies unencrypted at rest, undermining confidentiality. Privileged insiders or compromised service components could access plaintext during persistence windows, causing data exposure. You also lose KMS controls such as key policies, rotation, and detailed audit trails.

Recommendation

Enable server-side encryption on all SNS topics with AWS KMS; prefer customer-managed keys for control. Apply least privilege on key use, enforce rotation, and monitor key/access logs. Minimize sensitive data in messages and use end-to-end encryption where feasible to add defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws sns set-topic-attributes —topic-arn <TOPIC_ARN> —attribute-name KmsMasterKeyId —attribute-value alias/aws/sns

# Enable SSE for an SNS topic
resource "aws_sns_topic" "<example_resource_name>" {
  name               = "<example_resource_name>"
  kms_master_key_id  = "alias/aws/sns" # Critical: Enables encryption at rest
}

# CloudFormation: Enable SSE for an SNS topic
Resources:
  <example_resource_name>:
    Type: AWS::SNS::Topic
    Properties:
      KmsMasterKeyId: alias/aws/sns  # Critical: Enables encryption at rest with AWS managed KMS key

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sns_topics_kms_encryption_at_rest_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SNS subscription uses an HTTPS endpoint SNS topic is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires