SQS Queue Should Enforce Server Side Encryption

More Info:

Amazon SQS queues should enforce Server-Side Encryption (SSE) to protect the contents of their messages. This way contents of your messages will be unavailable to unauthorized or anonymous users.

Risk Level

High

Addresses

Security

Compliance Standards

HIPAA,ISO27001,HITRUST,NISTCSF,SEBI

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the misconfiguration of SQS Queue not enforcing server-side encryption in AWS using AWS CLI, follow these steps:

List all the existing SQS Queues to identify the one that needs to be remediated:

aws sqs list-queues

Get the attributes of the specific SQS Queue that needs to enforce server-side encryption. Replace queue-url with the URL of the SQS Queue:

aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All

Enable server-side encryption on the SQS Queue. Replace queue-url with the URL of the SQS Queue:

aws sqs set-queue-attributes --queue-url <queue-url> --attributes KmsMasterKeyId=alias/aws/sqs, KmsDataKeyReusePeriodSeconds=300, KmsDataKeyReusePeriodSeconds=300

Verify that server-side encryption is enabled on the SQS Queue by checking the attributes again:

aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All

By following these steps, you can successfully remediate the misconfiguration of SQS Queue not enforcing server-side encryption in AWS using AWS CLI.

Using Python

To enforce server-side encryption for an AWS SQS queue using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Initialize the SQS client:

sqs = boto3.client('sqs')

Get the URL of the SQS queue:

queue_url = 'YOUR_QUEUE_URL'

Update the SQS queue attributes to enable server-side encryption:

response = sqs.set_queue_attributes(
    QueueUrl=queue_url,
    Attributes={
        'KmsMasterKeyId': 'YOUR_KMS_KEY_ID',
        'KmsDataKeyReusePeriodSeconds': '300',  # Optional, specify the data key reuse period
        'Policy': '{"Version": "2012-10-17","Id": "Queue_Policy","Statement": [{"Effect": "Allow","Principal": "*","Action": "SQS:SendMessage","Resource": "YOUR_QUEUE_ARN","Condition": {"StringEquals": {"aws:SourceAccount": "YOUR_ACCOUNT_ID"}}}]}'
    }
)

Replace YOUR_QUEUE_URL, YOUR_KMS_KEY_ID, YOUR_QUEUE_ARN, and YOUR_ACCOUNT_ID with your actual values.

Verify that the server-side encryption is enabled for the SQS queue:

response = sqs.get_queue_attributes(
    QueueUrl=queue_url,
    AttributeNames=['All']
)
print(response['Attributes']['KmsMasterKeyId'])

By following these steps, you can remediate the misconfiguration and enforce server-side encryption for an AWS SQS queue using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

SQS Queue Should Enforce Server Side Encryption

More Info:

Risk Level

Addresses

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Addresses

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Addresses

Compliance Standards

Triage and Remediation

Remediation