(sqs): add SSE queue encryption for SQS

[blockvote]

Description

Currently you can only only select the following queue encryptions:

• UNENCRYPTED
• KMS_MANAGED
• KMS

However, via AWS Console you can also select SSE encryption.

Use Case

We use S3 events, that are automatically forwarded to SQS, but that doesn't work with KMS encryption, but it does with SSE (we tried this via AWS console).

Proposed Solution

Add a new option SSE to QueueEncryption:

aws-cdk/packages/@aws-cdk/aws-sqs/lib/queue.ts

Line 192 in 29039e8

export enum QueueEncryption {

Other information

No response

Acknowledge

• I may be able to implement this feature request
• This feature might incur a breaking change

[jumic]

I checked the documentation. This feature is currently not supported by CloudFormation.
A feature request already exists: aws-cloudformation/cloudformation-coverage-roadmap#989

[njlynch]

Thanks for the feature request, @blockvote , and the link to the CloudFormation tracker @jumic!

[a-h]

I'd also like to propose that SSE becomes the default for queues, and that queues that don't have KMS encryption enabled, get it enabled by default after the rollout.

This affects me because at present, the deadLetterQueueEnabled field on AWS Lambda creates an SQS queue. That queue is then not encrypted, which (depending on your use case) could lead to personal data being stored unencrypted at rest.

Any Lambda functions that use this behaviour will have their DLQs show up in AWS Security Hub because they don't have encryption at rest enabled.

[a-h]

I notice that the underlying CloudFormation support appears to be in place now (see comment), but (at time of writing) that the CloudFormation documentation hasn't been updated to reflect this, and the issue hasn't been commented on by the CloudFormation team.

aws-cloudformation/cloudformation-coverage-roadmap#989 (comment)

I assume that means we can't proceed until there's clarity. Perhaps internal to AWS there's a process for nudging this along? It looks like a zombie feature at the moment.

[jumic]

@otaviomacedo I'm not sure, if somebody from the CDK team has read @a-h's reply.
Do you have an internal contact to the CloudFormation/SQS team? If yes, maybe you can ask them to update the documentation. It looks like the feature is available now.

[danilobuerger]

Seems to be documented now: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queue.html#cfn-sqs-queue-sqsmanagedsseenabled

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.