SQS Server side encryption

[mbeldo]

Hey,

I want to add service side encryption to the queues created by lift, specifically the KmsMasterKeyId. Is this possible, if not can this property be exposed?

[t-richard]

This is not possible at the moment.

In Lift, we try to be start from the use cases rather than from the technical implementation.

Could you explain what is the use-case here? What could the configuration for this look like?

[BrutalSimplicity]

Random interested party here, but there are a few use cases I can see:

• This is fairly common in enterprise organizations with stricter security requirements. In one organization I've worked with they automatically provision a KMS key with their landing zones, and require the usage of it in all cases where the infrastructure allows.
• This is also required when using S3 event notifications when both targets require encryption. For example, an encrypted S3 event trigger to an encrypted SNS topic requires that they both share the same KMS key (by default, they do not), so you have to provision a CMK that is shared between the resources for the event notifications to be successful.

[mnapoli]

Thanks for the details.

To anyone stumbling on this issue with the same needs, please add a 👍 on the issue.

[salemdar]

@mnapoli I have created a PR to add the feature. Let me know if it needs any improvements.