AWS SNS Topic is not Encrypted


Amazon Simple Notification Service (SNS) is a managed publish-subscribe messaging service. When sensitive data is being processed or communicated, it's crucial to ensure that the data is encrypted to maintain its confidentiality. AWS provides server-side encryption for SNS topics, using the Key Management Service (KMS), to encrypt the messages stored in the topic.


1. Encrypt SNS Topic:

AWS Management Console:
  • Navigate to the SNS service.
  • Select Topics from the left pane.
  • Click on the topic you want to encrypt.
  • In the Details section, select Edit.
  • Under Encryption, check Enable encryption.
  • Choose the desired KMS key from the dropdown or create a new one.

To modify an SNS topic to use encryption:

aws sns set-topic-attributes --topic-arn <YOUR-TOPIC-ARN> --attribute-name KmsMasterKeyId --attribute-value <YOUR-KMS-KEY-ID>

Replace <YOUR-TOPIC-ARN> with the ARN of your SNS topic and <YOUR-KMS-KEY-ID> with your CMK ID.

resource "aws_sns_topic" "example" {
  name              = "example"
  kms_master_key_id = aws_kms_key.example.arn
  # ... other configurations ...

resource "aws_kms_key" "example" {
  description = "KMS key for SNS Topic Encryption"
  # other configurations...


For enhanced security, always ensure that your SNS topics, especially those handling sensitive information, are encrypted using a KMS key. Server-side encryption protects your data at rest and assures that the stored messages are encrypted and decrypted transparently, with the keys managed by AWS KMS.