Amazon SQS queues should be encrypted at rest

How to fix it

• Can break clients: Once the queue is encrypted, it refuses anonymous requests and any request not made over HTTPS with Signature Version 4.

In the console

Simple Queue Service → Queues → the queue → Edit → Encryption

Server-side encryption

Enabled, with Amazon SQS key (SSE-SQS) or AWS Key Management Service key (SSE-KMS)

KMS key

For SNS, S3 or EventBridge senders, a customer managed key granting them kms:GenerateDataKey and kms:Decrypt

With the AWS CLI

aws sqs set-queue-attributes --queue-url <queue-url> --attributes SqsManagedSseEnabled=true --region <region>

With Terraform

resource "aws_sqs_queue" "this" {
  name                    = var.queue_name
  sqs_managed_sse_enabled = true
}