Amazon SQS Queues Encrypted at Rest Rule

This rule ensures that Amazon SQS queues are encrypted at rest for enhanced security.

Rule	Amazon SQS queues should be encrypted at rest
Framework	AWS Foundational Security Best Practices
Severity	✔ Medium

Rule Description

According to AWS Foundational Security Best Practices, it is recommended to encrypt Amazon Simple Queue Service (SQS) queues at rest. Encrypting SQS queues provides an additional layer of security to protect sensitive data stored within the queues.

Rule Details

Rule ID: AWS-SECURITY-002
Service: Amazon Simple Queue Service (SQS)
Compliance Standard: AWS Foundational Security Best Practices
Severity: High
Remediation Action: Enable encryption for SQS queues.

Troubleshooting Steps

If you encounter issues with ensuring SQS queue encryption, follow these troubleshooting steps:

1.
Check if encryption is enabled on the SQS queue: Verify the encryption status of the SQS queue as it should be enabled.

2.
Verify key management settings: Ensure that the appropriate AWS Key Management Service (KMS) key is selected for encryption.

3.
Check for permission issues: Make sure the IAM user/role used for configuring the SQS queue has the necessary permissions to access the KMS key and enable encryption.

Code Example

To enable encryption for an existing SQS queue, you can use the AWS Command Line Interface (CLI) with the following command:

aws sqs set-queue-encryption --queue-url <queue_url> --kms-master-key-id <kms_key_id>

Replace

<queue_url>

with the URL of your SQS queue and

<kms_key_id>

with the ID of the KMS key you want to use for encryption.

Remediation Steps

Follow these steps to enable encryption for your SQS queue:

1.

Identify the SQS queue: Determine the URL or name of the SQS queue that needs encryption.

2.

Create or use an existing KMS key: If you don't have a suitable KMS key, create one through the AWS Management Console or AWS CLI. Ensure that the key is intended for use with SQS encryption.

3.
Enable encryption: Run the following AWS CLI command to enable encryption for the SQS queue:
```
aws sqs set-queue-encryption --queue-url <queue_url> --kms-master-key-id <kms_key_id>
```
Replace
```
<queue_url>
```
with the URL or name of your SQS queue and
```
<kms_key_id>
```
with the ID of the KMS key you want to use for encryption.
Alternatively, you can enable encryption for new queues by setting the
```
KmsMasterKeyId
```
parameter when creating the queue using the AWS SDK or AWS Management Console.

4.

Verify encryption: Once the encryption is enabled, check the encryption status of the SQS queue to ensure it is encrypted at rest.

By following these steps, you can successfully enable encryption for your Amazon SQS queues as per the AWS Foundational Security Best Practices.

Amazon SQS Queues Encrypted at Rest Rule

Is your System Free of Underlying Vulnerabilities? Find Out Now

Is your System Free of Underlying Vulnerabilities?
Find Out Now