The Server-Side Encryption (SSE) feature in AWS Simple Notification Service (SNS) ensures the security of the content of published messages within your SNS topics, making it a suitable choice for applications with strict encryption compliance and regulatory requirements. To provide additional protection for sensitive data delivered as messages to subscribers, enable Server-Side Encryption (SSE) for your AWS SNS topics. By enabling the SSE feature, AWS SNS encrypts messages using a 256-bit AES-GCM algorithm and a Customer Master Key (CMK) issued by Amazon KMS service as soon as messages are published to encrypted topics. The AWS SNS Server-Side Encryption feature can function with both AWS-managed CMKs and customer-managed CMKs.
To ensure additional protection of sensitive data delivered as messages to subscribers in AWS Simple Notification Service (SNS), follow these remediation steps to enable encryption:
Once SSE encryption is enabled for your SNS topic, messages published to the encrypted topic will be immediately encrypted using a 256-bit AES-GCM algorithm and a Customer Master Key (CMK) issued by Amazon KMS service. This will help you meet strict encryption compliance and regulatory requirements, and ensure the protection of sensitive data in your SNS messages.
