Check that SNS topics are encrypted

Documentos > Code Analysis > Static Analysis Rules > Check that SNS topics are encrypted

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: terraform-aws/aws-sns-topic-encryption

Language: Terraform

Severity: Warning

Category: Security

Description

This rule checks that all Simple Notification Service (SNS) topics created in your Terraform scripts are encrypted using a Key Management Service (KMS) key. SNS is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients. As such, it is crucial to ensure that all messages sent via SNS topics are encrypted to protect sensitive data from unauthorized access.

Encryption is an essential step in securing your AWS SNS topics. Without encryption, any data sent through your SNS topics is vulnerable to interception and unauthorized access. This can lead to data breaches and non-compliance with data protection regulations.

To avoid violating this rule, ensure that you specify a kms_master_key_id for each aws_sns_topic in your Terraform scripts. This key ID should reference a valid AWS KMS key that you have permissions to use. By doing so, you ensure that all messages sent through your SNS topics are encrypted using the specified KMS key. This is a best practice for maintaining the security and integrity of your data.

Non-Compliant Code Examples

resource "aws_sns_topic" "default" {
  name = "example"
}

Compliant Code Examples

resource "aws_sns_topic" "default" {
  name = "example"

  kms_master_key_id = "aws_kms_key.arn"
}