Skip to main content

🛡️ AWS SNS Topic is not encrypted with a KMS key🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS SNS Topics that are not configured with server-side encryption (SSE) using an AWS KMS key.

Rationale​

Enabling server-side encryption for SNS topics is a security measure that protects message data stored at rest. Using an AWS KMS key provides centralized management of encryption keys, including key rotation, access control, and auditing capabilities, helping to maintain compliance with organizational and regulatory data protection standards.

Audit​

This policy flags an SNS Topic as INCOMPLIANT if the KMS Key ID field is empty.

Remediation​

Open File

Remediation​

Enable Server-Side Encryption for SNS Topics Using KMS Keys​

From Command Line​

To enable server-side encryption for an SNS topic using an AWS KMS key, run the following command:

aws sns set-topic-attributes \
    --topic-arn {{topic-arn}} \
    --attribute-name KmsMasterKeyId \
    --attribute-value {{kms-key-id}}
Additional Considerations​

Include the following in the key policy to allow Amazon SNS to encrypt and decrypt messages:

{ 
    "Effect": "Allow", 
    "Principal": { 
        "Service": "sns.amazonaws.com" 
     },
    "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
    ],
    "Resource": "*",
    "Condition": {
        "ArnLike": { 
            "aws:SourceArn": "arn:aws:{{service}}:{{region}}:{{account-id}}:{{resource-type}}/{{resource-id}}" 
        },
        "StringEquals": { 
            "kms:EncryptionContext:aws:sns:topicArn": "arn:aws:sns:{{region}}:{{account-id}}:{{sns-topic-name}}" 
        }
    }
}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest19no data
💼 Cloudaware Framework → 💼 Data Encryption66no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)10873no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)16no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1640no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1735no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)524no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)42no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)135no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)24no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)759no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)40no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)135no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)24no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events161no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected173no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected149no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected169no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage112no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks39no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7 Boundary Protection29480no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration16no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection429no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest31736no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1024no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection25no data