Amazon SQS queues should be encrypted to protect sensitive message data at rest.
Amazon Simple Queue Service (SQS) is a managed message queuing service for application-to-application communication. SQS can store messages encrypted as soon as they are received. This rule raises an issue when an SQS queue is created with encryption explicitly disabled.
If an adversary gains physical access to the storage medium or otherwise reads a message from the file system, for example through a vulnerability in the service, they can access the data. This could result in the exposure of sensitive information such as personal data, credentials, or business-critical messages.
Encryption and decryption are handled transparently by SQS, so no further modifications to the application are necessary.
For aws_sqs_queue:
resource "aws_sqs_queue" "queue" {
name = "sqs-unencrypted"
sqs_managed_sse_enabled = false # Noncompliant, encryption disabled
}
For aws_sqs_queue:
resource "aws_sqs_queue" "queue" {
name = "sqs-encrypted"
sqs_managed_sse_enabled = true
}