SNS topic should use a customer-managed KMS key for encryption

What it checks

SNS topic: no KMS key is configured for server-side encryption.

Where it applies

Terraform: aws_sns_topic

CloudFormation: AWS::SNS::Topic

How to fix it

1. Set kms_master_key_id = aws_kms_key.<name>.arn to enable SSE. Existing topics can be updated without subscriber disruption.

Frameworks

• AWS FSBP SNS.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules