Ensure server side encryption (SSE) is enabled for Amazon Simple Notification Service (SNS) Topic

MEDIUM

Description

AWS SNS Topics has server side encryption (SSE) disabled which may lead to sensitive data exposure.

Remediation

In AWS Console -

  1. Sign in to AWS Console and go to the Amazon SNS console.
  2. In the navigation panel, select Topics.
  3. In the Topics page, select a topic and select Actions, Edit.
  4. Expand the Encryption section and do the following:
    a. Choose Enable encryption.
    b. Specify the customer master key (CMK).

In Terraform -

  1. In the aws_sns_topic resource, set the kms_kms_master_key_id field to a valid KMS key.

References:
https://docs.aws.amazon.com/sns/latest/dg/sns-key-management.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic#kms_master_key_id

Policy Details

Rule Reference ID: AC_AWS_0364
CSP: AWS
Remediation Available: Yes
Resource: aws_sns_topic
Resource Category: Messaging

Frameworks