Queue server side encryption remediation

Using Console

Using CLI

To remediate the misconfiguration of SQS Queue not enforcing server-side encryption in AWS using AWS CLI, follow these steps:

List all the existing SQS Queues to identify the one that needs to be remediated:

aws sqs list-queues

Get the attributes of the specific SQS Queue that needs to enforce server-side encryption. Replace queue-url with the URL of the SQS Queue:

aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All

Enable server-side encryption on the SQS Queue. Replace queue-url with the URL of the SQS Queue:

aws sqs set-queue-attributes --queue-url <queue-url> --attributes KmsMasterKeyId=alias/aws/sqs, KmsDataKeyReusePeriodSeconds=300, KmsDataKeyReusePeriodSeconds=300

Verify that server-side encryption is enabled on the SQS Queue by checking the attributes again:

aws sqs get-queue-attributes --queue-url <queue-url> --attribute-names All

By following these steps, you can successfully remediate the misconfiguration of SQS Queue not enforcing server-side encryption in AWS using AWS CLI.

Using Python

To enforce server-side encryption for an AWS SQS queue using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Initialize the SQS client:

sqs = boto3.client('sqs')

Get the URL of the SQS queue:

queue_url = 'YOUR_QUEUE_URL'

Update the SQS queue attributes to enable server-side encryption:

response = sqs.set_queue_attributes(
    QueueUrl=queue_url,
    Attributes={
        'KmsMasterKeyId': 'YOUR_KMS_KEY_ID',
        'KmsDataKeyReusePeriodSeconds': '300',  # Optional, specify the data key reuse period
        'Policy': '{"Version": "2012-10-17","Id": "Queue_Policy","Statement": [{"Effect": "Allow","Principal": "*","Action": "SQS:SendMessage","Resource": "YOUR_QUEUE_ARN","Condition": {"StringEquals": {"aws:SourceAccount": "YOUR_ACCOUNT_ID"}}}]}'
    }
)

Replace YOUR_QUEUE_URL, YOUR_KMS_KEY_ID, YOUR_QUEUE_ARN, and YOUR_ACCOUNT_ID with your actual values.

Verify that the server-side encryption is enabled for the SQS queue:

response = sqs.get_queue_attributes(
    QueueUrl=queue_url,
    AttributeNames=['All']
)
print(response['Attributes']['KmsMasterKeyId'])

By following these steps, you can remediate the misconfiguration and enforce server-side encryption for an AWS SQS queue using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Queue server side encryption remediation

Triage and Remediation

Remediation