> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SQS Queue Should Enforce Server Side Encryption

### More Info:

Amazon SQS queues should enforce Server-Side Encryption (SSE) to protect the contents of their messages. This way contents of your messages will be unavailable to unauthorized or anonymous users.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of an SQS Queue not enforcing server-side encryption in AWS using the AWS Management Console, follow these step-by-step instructions:

        1. **Sign in to the AWS Management Console:**
           * Go to [https://aws.amazon.com](https://aws.amazon.com) and sign in to the AWS Management Console using your IAM credentials.

        2. **Navigate to the Amazon SQS service:**
           * From the AWS Management Console, search for "SQS" or find the "Simple Queue Service" under the "Messaging" section.

        3. **Select the SQS Queue requiring encryption:**
           * Click on the SQS Queue that needs to enforce server-side encryption.

        4. **Configure Server-Side Encryption:**
           * In the SQS Queue details page, click on the "Configure Queue" button.

        5. **Enable Server-Side Encryption:**
           * Under the "Server-side encryption" section, select the option to enable server-side encryption.

        6. **Choose Encryption Key:**
           * Choose the Customer Master Key (CMK) from AWS Key Management Service (KMS) that you want to use for encrypting the messages in the SQS Queue.

        7. **Save Changes:**
           * Click on the "Save Changes" button to apply the server-side encryption configuration to the SQS Queue.

        8. **Verify Encryption Configuration:**
           * To ensure that server-side encryption is enforced, you can check the SQS Queue settings to confirm that encryption is enabled.

        By following these steps, you have successfully enforced server-side encryption for the SQS Queue in AWS using the AWS Management Console. This will help in securing the messages stored in the queue and ensure compliance with security best practices.
      </Accordion>

      <Accordion title="Using CLI">
        #

        To remediate the misconfiguration of SQS Queue not enforcing server-side encryption in AWS using AWS CLI, follow these steps:

        1. List all the existing SQS Queues to identify the one that needs to be remediated:

        ```bash theme={null}
        aws sqs list-queues
        ```

        2. Get the attributes of the specific SQS Queue that needs to enforce server-side encryption. Replace `queue-url` with the URL of the SQS Queue:

        ```bash theme={null}
        aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All
        ```

        3. Enable server-side encryption on the SQS Queue. Replace `queue-url` with the URL of the SQS Queue:

        ```bash theme={null}
        aws sqs set-queue-attributes --queue-url <queue-url> --attributes KmsMasterKeyId=alias/aws/sqs, KmsDataKeyReusePeriodSeconds=300, KmsDataKeyReusePeriodSeconds=300
        ```

        4. Verify that server-side encryption is enabled on the SQS Queue by checking the attributes again:

        ```bash theme={null}
        aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All
        ```

        By following these steps, you can successfully remediate the misconfiguration of SQS Queue not enforcing server-side encryption in AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enforce server-side encryption for an AWS SQS queue using Python, you can follow these steps:

        1. Import the necessary libraries:

        ```python theme={null}
        import boto3
        ```

        2. Initialize the SQS client:

        ```python theme={null}
        sqs = boto3.client('sqs')
        ```

        3. Get the URL of the SQS queue:

        ```python theme={null}
        queue_url = 'YOUR_QUEUE_URL'
        ```

        4. Update the SQS queue attributes to enable server-side encryption:

        ```python theme={null}
        response = sqs.set_queue_attributes(
            QueueUrl=queue_url,
            Attributes={
                'KmsMasterKeyId': 'YOUR_KMS_KEY_ID',
                'KmsDataKeyReusePeriodSeconds': '300',  # Optional, specify the data key reuse period
                'Policy': '{"Version": "2012-10-17","Id": "Queue_Policy","Statement": [{"Effect": "Allow","Principal": "*","Action": "SQS:SendMessage","Resource": "YOUR_QUEUE_ARN","Condition": {"StringEquals": {"aws:SourceAccount": "YOUR_ACCOUNT_ID"}}}]}'
            }
        )
        ```

        Replace `YOUR_QUEUE_URL`, `YOUR_KMS_KEY_ID`, `YOUR_QUEUE_ARN`, and `YOUR_ACCOUNT_ID` with your actual values.

        5. Verify that the server-side encryption is enabled for the SQS queue:

        ```python theme={null}
        response = sqs.get_queue_attributes(
            QueueUrl=queue_url,
            AttributeNames=['All']
        )
        print(response['Attributes']['KmsMasterKeyId'])
        ```

        By following these steps, you can remediate the misconfiguration and enforce server-side encryption for an AWS SQS queue using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_sqs_queue" "THIS_QUEUE" {
          name = "REPLACE_WITH_QUEUE_NAME"

          # Option 1: Match CLI "SqsManagedSseEnabled":"true"  (SSE-SQS)
          # This enables encryption with SQS-managed keys.
          sqs_managed_sse_enabled = true

          # ---- OR ----

          # Option 2: Match CLI "KmsMasterKeyId":"alias/aws/sqs"  (SSE-KMS)
          # Use the default AWS-managed KMS key for SQS, or replace with your CMK ARN/ID.
          # kms_master_key_id = "alias/aws/sqs"

          # Optionally, for SSE-KMS you can also control data key reuse:
          # kms_data_key_reuse_period_seconds = 300
        }
        ```

        Substitute:

        * `THIS_QUEUE` with your Terraform local name.
        * `REPLACE_WITH_QUEUE_NAME` with the actual SQS queue name.
        * For SSE-KMS, change `alias/aws/sqs` if you want a customer-managed KMS key.

        This encryption change is an in-place update for an existing queue (no forced replacement), though it can affect permissions for producers/consumers (they must satisfy KMS requirements when using SSE-KMS).

        After updating the code and running `terraform plan`, you should see:

        * either `sqs_managed_sse_enabled` changing from `false` (or `null`) to `true`,
        * or `kms_master_key_id` being added/updated (and possibly `kms_data_key_reuse_period_seconds`),\
          with the queue resource being updated in place, not recreated.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>