Policy: AWS > Turbot > Event Handlers > SNS > Topic > Customer Managed Key

A Customer Managed KMS key used for server side encryption of the SNS topic used created for the AWS Event Handlers.

If no key is specified, server side encryption will not be enabled.

If the specified key does not exist in AWS or is improperly specified in the policy, the SNS topic will silently stop working and halt event handling for the region. Resolve by picking an existing key or removing this policy.

Note that the key will not be created in this stack - it must already exist. The key policy must grant the kms:GenerateDataKey* and kms:Decrypt permissions to Amazon CloudWatch Events (events.amazonaws.com). The Guardrails user must also have permissions to decrypt messages with this CMK.

See https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html