SQS queue without inline redrive should specify a KMS encryption key

What it checks

SQS queue: no inline redrive policy or explicit KMS key is authored.

Where it applies

Terraform: aws_sqs_queue

CloudFormation: AWS::SQS::Queue

How to fix it

1. Review the required key control and set kms_master_key_id on this queue. Verify producer and consumer KMS permissions before changing encryption.

Frameworks

• AWS FSBP SQS.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules