binaryalert icon indicating copy to clipboard operation
binaryalert copied to clipboard

SNS topics should be encrypted too

Open jdheyburn opened this issue 5 years ago • 0 comments

Background

Currently SNS topics are not encrypted and thus are flagged as a security issue.

Desired Change

An equivalent KMS key generated for SNS. Here is an example pulled from kms.tf to encrypt SQS.

// KMS key for server-side encryption (SSE) of SQS
resource "aws_kms_key" "sse_sqs" {
  description         = "BinaryAlert Server-Side Encryption - SQS"
  enable_key_rotation = true

  tags = {
    Name = var.tagged_name
  }

  policy = data.aws_iam_policy_document.kms_allow_s3.json
}

resource "aws_kms_alias" "sse_sqs_alias" {
  name          = "alias/${var.name_prefix}_binaryalert_sse_sqs"
  target_key_id = aws_kms_key.sse_sqs.key_id
}

jdheyburn avatar Aug 27 '20 12:08 jdheyburn