SNS topics should be encrypted at-rest using AWS KMS

How to fix it

• Can break clients: Publishers then need kms:GenerateDataKey* and kms:Decrypt on the key, and AWS services such as CloudWatch alarms can publish only with a customer managed key that grants them.

In the console

Simple Notification Service → Topics → the topic → Edit → Encryption

Encryption

Enable

AWS KMS key

alias/aws/sns, or a customer managed key if AWS services such as CloudWatch alarms publish to the topic

With the AWS CLI

aws sns set-topic-attributes --topic-arn <topic-arn> --attribute-name KmsMasterKeyId --attribute-value <kms-key-id> --region <region>

With Terraform

resource "aws_sns_topic" "this" {
  name              = var.topic_name
  kms_master_key_id = var.kms_key_id
}