Description

Detects Amazon SQS queues that are operating without encryption enabled. SQS queues without encryption store messages in plaintext, potentially exposing sensitive data. The detector checks for both SSE-SQS (SQS-managed encryption) and SSE-KMS (customer managed KMS keys) being disabled.

Detection Strategy

• Retrieves all SQS queues in the specified AWS region

• For each queue, checks if SQS-managed server-side encryption (SqsManagedSseEnabled) is set to false

• Verifies if no KMS key (KmsMasterKeyId) is configured for the queue

• Reports a vulnerability if both encryption methods are disabled (no SSE-SQS and no KMS key configured)