Amazon Simple Queue Service

Developer Guide

AWS Documentation » Amazon Simple Queue Service » Developer Guide » Amazon SQS Security » Protecting Amazon SQS Data Using Server-Side Encryption (SSE) and AWS KMS

Protecting Amazon SQS Data Using Server-Side Encryption (SSE) and AWS KMS

Server-side encryption (SSE) lets you transmit sensitive data in encrypted queues. SSE protects the contents of messages in Amazon SQS queues using keys managed in AWS Key Management Service (AWS KMS). For information about managing SSE using the AWS Management Console or the AWS SDK for Java (and the CreateQueue, SetQueueAttributes, and GetQueueAttributes actions), see the following tutorials:

SSE encrypts messages as soon as Amazon SQS receives them. The messages are stored in encrypted form and Amazon SQS decrypts messages only when they are sent to an authorized consumer.

AWS KMS combines secure, highly available hardware and software to provide a key management system scaled for the cloud. When you use Amazon SQS with AWS KMS, the data keys that encrypt your message data are also encrypted and stored with the data they protect.

The following are benefits of using AWS KMS:

For more information, see What is AWS Key Management Service? in the AWS Key Management Service Developer Guide and the AWS Key Management Service Cryptographic Details whitepaper.

Encryption Scope

SSE encrypts the body of a message in an Amazon SQS queue.

SSE doesn't encrypt the following:

Encrypting a message makes its contents unavailable to unauthorized or anonymous users. This doesn't affect the normal functioning of Amazon SQS:

Moving a message to a dead-letter queue doesn't affect its encryption:

Key Terms

The following key terms can help you better understand the functionality of SSE. For detailed descriptions, see the Amazon Simple Queue Service API Reference.

Understanding the Data Key Reuse Period

Amazon SQS uses a single customer master key (either the AWS managed CMK for Amazon SQS or a custom CMK) to provide envelope encryption and decryption of multiple Amazon SQS messages during the data key reuse period. To make the most of the data key reuse period, keep the following in mind:

Estimating AWS KMS Costs

To predict costs and better understand your AWS bill, you might want to know how often Amazon SQS uses your customer master key (CMK).

To calculate the number of API requests (R) per queue, use the following formula:

R = B / D * (2 * P + C)

B is the billing period (in seconds).

D is the data key reuse period (in seconds).

P is the number of producing principals that send to the Amazon SQS queue.

C is the number of consuming principals that receive from the Amazon SQS queue.

The following are example calculations. For exact pricing information, see AWS Key Management Service Pricing.

Example 1: Calculating the Number of AWS KMS API Calls for 2 Principals and 1 Queue

This example assumes the following:

2,678,400 / 300 * (2 * 1 + 1) = 26,784

Example 2: Calculating the Number of AWS KMS API Calls for Multiple Producers and Consumers and 2 Queues

This example assumes the following:

(2,419,200 / 86,400 * (2 * 3 + 1)) + (2,419,200 / 86,400 * (2 * 5 + 2)) = 532

Configuring AWS KMS Permissions

Before you can use SSE, you must configure AWS KMS key policies to allow encryption of queues and encryption and decryption of messages. For examples and more information about AWS KMS permissions, see AWS KMS API Permissions: Actions and Resources Reference in the AWS Key Management Service Developer Guide.

You must also ensure that the key policies of the customer master key (CMK) allow the necessary permissions. To do this, name the principals that produce and consume encrypted messages in Amazon SQS as users in the CMK key policy.

Alternatively, you can specify the required AWS KMS actions and CMK ARN in an IAM policy assigned to the principals that produce and consume encrypted messages in Amazon SQS. For more information, see Managing Access to AWS KMS CMKs in the AWS Key Management Service Developer Guide.

Allow a User to Send Single or Batched Messages to a Queue with SSE

The producer must have the kms:GenerateDataKey and kms:Decrypt permissions for the customer master key (CMK).

{
   "Version": "2012-10-17",
      "Statement": [{
         "Effect": "Allow",
         "Action": [
            "kms:GenerateDataKey",
            "kms:Decrypt"
         ],
         "Resource": "arn:aws:kms:us-east-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
         }, {
         "Effect": "Allow",
         "Action": [
            "sqs:SendMessage",
            "sqs:SendMessageBatch"
         ],
         "Resource": "arn:aws:sqs:*:123456789012:MyQueue"
      }]
}

Allow a User to Receive Messages from a Queue with SSE

The consumer must have the kms:Decrypt permission for any customer master key (CMK) that is used to encrypt the messages in the specified queue. If the queue acts as a dead-letter queue, the consumer must also have the kms:Decrypt permission for any CMK that is used to encrypt the messages in the source queue.

{
   "Version": "2012-10-17",
      "Statement": [{
         "Effect": "Allow",
         "Action": [
            "kms:Decrypt"
         ],
         "Resource": "arn:aws:kms:us-east-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
         }, {
         "Effect": "Allow",
         "Action": [
            "sqs:ReceiveMessage"
         ],
         "Resource": "arn:aws:sqs:*:123456789012:MyQueue"
      }]
}

Enable Compatibility between AWS Services Such as Amazon CloudWatch Events, Amazon S3, and Amazon SNS and Encrypted Queues

To allow Amazon CloudWatch Events, Amazon S3 event notifications, or Amazon SNS topic subscriptions to work with encrypted queues, you must perform the following steps:

1. Create a customer master key (CMK).

2. To allow the AWS service feature to have the kms:GenerateDataKey* and kms:Decrypt permissions, add the following statement to the policy of the CMK.

   Note

   • For Amazon CloudWatch Events, use events

   • For Amazon S3 event notifications, use s3

   • For Amazon SNS topic subscriptions, use sns

   {
      "Version": "2012-10-17",
         "Statement": [{
            "Effect": "Allow",
            "Principal": {
               "Service": "service.amazonaws.com"
            },
            "Action": [
               "kms:GenerateDataKey*",
               "kms:Decrypt"
            ],
            "Resource": "*"
          }]
   }

3. Create a new SSE queue or configure an existing SSE queue using the ARN of your CMK.

Learn More

Errors

When you work with Amazon SQS and AWS KMS, you might encounter errors. The following list describes the errors and possible troubleshooting solutions.

On this page:

• Encryption Scope
• Key Terms
• Understanding the Data Key Reuse Period
• Estimating AWS KMS Costs
• Configuring AWS KMS Permissions
• Errors