Back to Checks
aws

SNS topic is encrypted at rest with KMS

sns_topics_kms_encryption_at_rest_enabled
Service: snsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsSnsTopic

Amazon SNS topics are assessed for server-side encryption with AWS KMS. Topics lacking a configured KMS key (e.g., missing kms_master_key_id) are identified as unencrypted at rest.

Prowler logoProwlerprowler-provider-aws

Risk

Without KMS-backed SSE, SNS stores message bodies unencrypted at rest, undermining confidentiality.

Privileged insiders or compromised service components could access plaintext during persistence windows, causing data exposure. You also lose KMS controls such as key policies, rotation, and detailed audit trails.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sns_topics_kms_encryption_at_rest_enabled

Recommendation

Enable server-side encryption on all SNS topics with AWS KMS; prefer customer-managed keys for control.

Apply least privilege on key use, enforce rotation, and monitor key/access logs. Minimize sensitive data in messages and use end-to-end encryption where feasible to add defense in depth.

Remediation

CLI

aws sns set-topic-attributes --topic-arn <TOPIC_ARN> --attribute-name KmsMasterKeyId --attribute-value alias/aws/sns

Terraform

# Enable SSE for an SNS topic
resource "aws_sns_topic" "<example_resource_name>" {
  name               = "<example_resource_name>"
  kms_master_key_id  = "alias/aws/sns" # Critical: Enables encryption at rest
}

NativeIaC

# CloudFormation: Enable SSE for an SNS topic
Resources:
  <example_resource_name>:
    Type: AWS::SNS::Topic
    Properties:
      KmsMasterKeyId: alias/aws/sns  # Critical: Enables encryption at rest with AWS managed KMS key

Other

1Open the AWS Console and go to Amazon SNS > Topics
2Select the topic and click Edit
3Under Encryption, enable encryption and choose the AWS managed key for SNS (alias/aws/sns)
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sns.sns_client import sns_client


class sns_topics_kms_encryption_at_rest_enabled(Check):
    def execute(self):
        findings = []
        for topic in sns_client.topics:
            report = Check_Report_AWS(metadata=self.metadata(), resource=topic)
            report.status = "PASS"
            report.status_extended = f"SNS topic {topic.name} is encrypted."
            if not topic.kms_master_key_id:
                report.status = "FAIL"
                report.status_extended = f"SNS topic {topic.name} is not encrypted."

            findings.append(report)

        return findings

References