1. Sign in to the AWS Management Console:
   • Go to https://aws.amazon.com and sign in to the AWS Management Console using your IAM credentials.
2. Navigate to the Amazon SQS service:
   • From the AWS Management Console, search for “SQS” or find the “Simple Queue Service” under the “Messaging” section.
3. Select the SQS Queue requiring encryption:
   • Click on the SQS Queue that needs to enforce server-side encryption.
4. Configure Server-Side Encryption:
   • In the SQS Queue details page, click on the “Configure Queue” button.
5. Enable Server-Side Encryption:
   • Under the “Server-side encryption” section, select the option to enable server-side encryption.
6. Choose Encryption Key:
   • Choose the Customer Master Key (CMK) from AWS Key Management Service (KMS) that you want to use for encrypting the messages in the SQS Queue.
7. Save Changes:
   • Click on the “Save Changes” button to apply the server-side encryption configuration to the SQS Queue.
8. Verify Encryption Configuration:
   • To ensure that server-side encryption is enforced, you can check the SQS Queue settings to confirm that encryption is enabled.

​

1. List all the existing SQS Queues to identify the one that needs to be remediated:

aws sqs list-queues

2. Get the attributes of the specific SQS Queue that needs to enforce server-side encryption. Replace queue-url with the URL of the SQS Queue:

aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All

3. Enable server-side encryption on the SQS Queue. Replace queue-url with the URL of the SQS Queue:

aws sqs set-queue-attributes --queue-url <queue-url> --attributes KmsMasterKeyId=alias/aws/sqs, KmsDataKeyReusePeriodSeconds=300, KmsDataKeyReusePeriodSeconds=300

4. Verify that server-side encryption is enabled on the SQS Queue by checking the attributes again:

aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All

1. Import the necessary libraries:

import boto3

2. Initialize the SQS client:

sqs = boto3.client('sqs')

3. Get the URL of the SQS queue:

queue_url = 'YOUR_QUEUE_URL'

4. Update the SQS queue attributes to enable server-side encryption:

response = sqs.set_queue_attributes(
    QueueUrl=queue_url,
    Attributes={
        'KmsMasterKeyId': 'YOUR_KMS_KEY_ID',
        'KmsDataKeyReusePeriodSeconds': '300',  # Optional, specify the data key reuse period
        'Policy': '{"Version": "2012-10-17","Id": "Queue_Policy","Statement": [{"Effect": "Allow","Principal": "*","Action": "SQS:SendMessage","Resource": "YOUR_QUEUE_ARN","Condition": {"StringEquals": {"aws:SourceAccount": "YOUR_ACCOUNT_ID"}}}]}'
    }
)

5. Verify that the server-side encryption is enabled for the SQS queue:

response = sqs.get_queue_attributes(
    QueueUrl=queue_url,
    AttributeNames=['All']
)
print(response['Attributes']['KmsMasterKeyId'])

resource "aws_sqs_queue" "THIS_QUEUE" {
  name = "REPLACE_WITH_QUEUE_NAME"

  # Option 1: Match CLI "SqsManagedSseEnabled":"true"  (SSE-SQS)
  # This enables encryption with SQS-managed keys.
  sqs_managed_sse_enabled = true

  # ---- OR ----

  # Option 2: Match CLI "KmsMasterKeyId":"alias/aws/sqs"  (SSE-KMS)
  # Use the default AWS-managed KMS key for SQS, or replace with your CMK ARN/ID.
  # kms_master_key_id = "alias/aws/sqs"

  # Optionally, for SSE-KMS you can also control data key reuse:
  # kms_data_key_reuse_period_seconds = 300
}

• THIS_QUEUE with your Terraform local name.
• REPLACE_WITH_QUEUE_NAME with the actual SQS queue name.
• For SSE-KMS, change alias/aws/sqs if you want a customer-managed KMS key.

• either sqs_managed_sse_enabled changing from false (or null) to true,
• or kms_master_key_id being added/updated (and possibly kms_data_key_reuse_period_seconds),
  with the queue resource being updated in place, not recreated.