Description

Detects AWS SQS queues configured without server-side encryption in CloudFormation templates. When server-side encryption is disabled on SQS queues, messages are stored in plaintext, potentially exposing sensitive data to unauthorized access. This violates security best practices requiring encryption at rest for message queues.

Detection Strategy

• Search for CloudFormation resources of type 'AWS::SQS::Queue' in the template

• Check if the SQS queue resource is missing the SqsManagedSseEnabled property or if it's explicitly set to false

• Check if the KmsMasterKeyId property is not specified, indicating no custom KMS key encryption

• Flag the queue resource as vulnerable if server-side encryption is not enabled through either SSE-SQS or SSE-KMS

Vulnerable code example

Resources:
  VulnSQSQueue:
    Type: 'AWS::SQS::Queue'
    Properties:
      QueueName: 'UnsecureQueue'
      # Vulnerable: Explicitly disabling SQS encryption at rest
      SqsManagedSseEnabled: False

✅ Secure code example

Resources:
  SecureSQSQueue:
    Type: 'AWS::SQS::Queue'
    Properties:
      QueueName: 'SecureQueue'
      # Enable SQS-managed server-side encryption for data protection at rest
      SqsManagedSseEnabled: true