SQS queue has server-side encryption explicitly disabled

What it checks

SQS queue has server-side encryption explicitly disabled

Where it applies

Terraform: aws_sqs_queue

CloudFormation: AWS::SQS::Queue

How to fix it

1. Set sqs_managed_sse_enabled = true to enable SSE-SQS (SQS-managed keys, no KMS charges), or set kms_master_key_id to a KMS key ARN/alias for SSE-KMS. Existing queues update in place; only messages sent after the change are encrypted (backlogged messages are not re-encrypted).

Frameworks

• AWS FSBP SQS.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules