SQS queue has server-side encryption enabled

Check ID: sqs_queues_server_side_encryption_enabled
Provider: AWS
Service: sqs
Severity: MEDIUM
Categories: encryption
Resource type: AwsSqsQueue

What this check verifies

Amazon SQS queues are evaluated for server-side encryption configured with a KMS key (SSE-KMS) protecting message bodies at rest. Queues without an associated KMS key are identified.

Risk

Without KMS-backed SSE, message bodies lack tenant-controlled keys and detailed audit. Secrets, tokens, or PII in messages become easier to access through privilege misuse, misconfiguration, or unintended integrations, reducing confidentiality and limiting containment since you cannot revoke access via key disable/rotation.

Recommendation

Enable SSE-KMS on all queues using a customer-managed KMS key.

Apply least privilege to key and queue policies; restrict Encrypt/Decrypt
Enforce key rotation and separation of duties
Tune data key reuse for security vs. cost
Monitor key and queue access to support defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws sqs set-queue-attributes --queue-url <QUEUE_URL> --attributes KmsMasterKeyId=<KMS_KEY_ID_OR_ALIAS>

# Enable SSE-KMS for an SQS queue
resource "aws_sqs_queue" "<example_resource_name>" {
  kms_master_key_id = "alias/aws/sqs"  # Critical: sets a KMS key, enabling SSE-KMS so the queue reports a kms_key_id
}

# CloudFormation: Enable SSE-KMS for an SQS queue
Resources:
  <example_resource_name>:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: alias/aws/sqs  # Critical: sets a KMS key, enabling SSE-KMS so the queue reports a kms_key_id

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sqs_queues_server_side_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SQS queue policy does not allow public access SSM document contains no secrets

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires