Back to Checks
aws

SQS queue has server-side encryption enabled

sqs_queues_server_side_encryption_enabled
Service: sqsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsSqsQueue

Amazon SQS queues are evaluated for server-side encryption configured with a KMS key (SSE-KMS) protecting message bodies at rest.

Queues without an associated KMS key are identified.

Prowler logoProwlerprowler-provider-aws

Risk

Without KMS-backed SSE, message bodies lack tenant-controlled keys and detailed audit. Secrets, tokens, or PII in messages become easier to access through privilege misuse, misconfiguration, or unintended integrations, reducing confidentiality and limiting containment since you cannot revoke access via key disable/rotation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sqs_queues_server_side_encryption_enabled

Recommendation

Enable SSE-KMS on all queues using a customer-managed KMS key.

  • Apply least privilege to key and queue policies; restrict Encrypt/Decrypt
  • Enforce key rotation and separation of duties
  • Tune data key reuse for security vs. cost
  • Monitor key and queue access to support defense in depth

Remediation

CLI

aws sqs set-queue-attributes --queue-url <QUEUE_URL> --attributes KmsMasterKeyId=<KMS_KEY_ID_OR_ALIAS>

Terraform

# Enable SSE-KMS for an SQS queue
resource "aws_sqs_queue" "<example_resource_name>" {
  kms_master_key_id = "alias/aws/sqs"  # Critical: sets a KMS key, enabling SSE-KMS so the queue reports a kms_key_id
}

NativeIaC

# CloudFormation: Enable SSE-KMS for an SQS queue
Resources:
  <example_resource_name>:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId: alias/aws/sqs  # Critical: sets a KMS key, enabling SSE-KMS so the queue reports a kms_key_id

Other

1In the AWS Console, go to Amazon SQS > Queues
2Select the queue and click Edit
3Expand Encryption
4Set Server-side encryption to Enabled
5For AWS KMS key, select alias/aws/sqs (or choose a specific KMS key)
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sqs.sqs_client import sqs_client


class sqs_queues_server_side_encryption_enabled(Check):
    def execute(self):
        findings = []
        for queue in sqs_client.queues:
            report = Check_Report_AWS(metadata=self.metadata(), resource=queue)
            report.status = "PASS"
            report.status_extended = (
                f"SQS queue {queue.id} is using Server Side Encryption."
            )
            if not queue.kms_key_id:
                report.status = "FAIL"
                report.status_extended = (
                    f"SQS queue {queue.id} is not using Server Side Encryption."
                )
            findings.append(report)

        return findings

References