AWS SQS Queue not configured with server side encryption misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_27
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	816b8edc-773e-44a9-ad28-f8375ffdfe42

Impact

Amazon Simple Queue Service (SQS) provides the ability to encrypt queues so sensitive data is passed securely. It uses server-side-encrypyion (SSE) and supports AWS-managed Customer Master Key (CMK), as well as self-created/self-managed keys. SSE encrypts only the body of the message, with queue metadata and message metadata out of scope, and backlogged messages not encrypted. If you operate in a regulated market, such as HIPAA for healthcare, PCI DSS for finance, or FedRAMP for government, you need to ensure sensitive data messages passed in this service are encrypted at rest. We recommend you encrypt Data Queued using SQS.

How to Fix

Resource: AWS::SQS::Queue

• Arguments: Properties.KmsMasterKeyId [source,go]

---

Type: AWS::SQS::Queue Properties: ...

• KmsMasterKeyId: "kms_id"

---