Control: AWS > SQS > Queue > Encryption in Transit

Define the Encryption in Transit settings required for AWS > SQS > Queue.

The Encryption in Transit control compares the Encryption in Transit settings against the Encryption in Transit policies for the resource (AWS > SQS > Queue > Encryption in Transit), raises an alarm, and takes the defined enforcement action.

Encryption in transit for AWS > SQS > Queue is enforced through the queue's resource policy: a Deny statement on sqs:* for all principals when the request is not sent over a secure transport (aws:SecureTransport is false). The control raises an alarm if the queue has no policy, or if no statement in the policy denies insecure access.

Encryption in transit is considered enabled when the policy contains any statement equivalent to the following. Statements are matched on meaning rather than on exact text, so the equivalent spellings AWS accepts all count as enabled: Principal as "*" or { "AWS": "*" }, Action as sqs:* or *, Resource as the queue ARN or *, single-element arrays in place of any of those, and a BoolIfExists condition operator. { Sid: "MustBeEncryptedInTransit", Effect: "Deny", Principal: "*", Action: "sqs:*", Resource: "arn:${partition}:sqs:${region}:${accountId}:${queueName}", Condition: { Bool: { "aws:SecureTransport": "false" } } }

A statement that carries additional conditions, or that narrows Action below sqs:*, does not deny every insecure request and so does not count as enabled. Statements using NotPrincipal, NotAction or NotResource are never treated as enabling encryption in transit.

In Enforce: Enabled, the statement above is added while every other statement on the queue policy is preserved. In Enforce: Disabled, only the statements that enforce encryption in transit are removed.