Rule: SNS topics should be encrypted at rest

Rule/Policy Description

Troubleshooting Steps

2. 1.

   Check SNS Encryption Settings: Ensure that the encryption settings for SNS topics are properly configured. Verify if the encryption option is enabled for your SNS topics.

4. 2.

   Verify Encryption Key: Ensure that the correct encryption key is being used for encrypting the SNS topics at rest. Validate the key being used and make sure it is active and accessible.

6. 3.

   Review IAM Policies: Check the associated IAM policies and ensure that they grant the necessary permissions for encrypting SNS topics at rest. Make any necessary adjustments to the IAM policies if needed.

8. 4.

   Test Permissions: Validate if the permissions assigned to IAM roles or users are correctly configured to allow encryption of SNS topics at rest. Test the permissions by attempting to encrypt a sample SNS topic.

10. 5.

    AWS KMS Configuration: If using AWS Key Management Service (KMS) for encryption, ensure that the KMS key policies are properly configured. Verify if the SNS service can access and use the KMS key for encryption.

12. 6.

    Review CloudTrail Logs: Check the AWS CloudTrail logs to identify any error or warning messages related to SNS topic encryption. Analyze the logs to diagnose and resolve any issues encountered.

14. 7.

    Seek AWS Support: If the troubleshooting steps above do not resolve the issue, reach out to AWS support for further assistance and guidance.

Necessary Codes

2. 1.
   To enable encryption at rest for an existing SNS topic (replace

   topic-arn

   with the actual ARN of your SNS topic):

aws sns set-topic-attributes --topic-arn <topic-arn> --attribute-name KmsMasterKeyId --attribute-value <kms-key-id>

2. 1.
   To retrieve the attributes of an SNS topic (replace

   topic-arn

   with the actual ARN of your SNS topic):

aws sns get-topic-attributes --topic-arn <topic-arn>

Step-by-Step Guide for Remediation

2. 1.

   Identify the SNS topics: Determine the SNS topics that require encryption at rest to protect personal data.

4. 2.

   Choose an encryption key: If you haven't already, choose an appropriate AWS KMS key under which the SNS topics will be encrypted. Ensure the encryption key is properly configured and has the necessary permissions.

6. 3.

   Enable encryption for SNS topics: Use the AWS CLI or AWS Management Console to enable encryption for each identified SNS topic.

   • If using the AWS CLI, run the command mentioned in the "Necessary Codes" section, replacing

     <topic-arn>

     with the ARN of each SNS topic, and

     <kms-key-id>

     with the ID or ARN of the chosen encryption key.

   • If using the AWS Management Console, locate the SNS topic, click on its properties, and enable encryption using the AWS Key Management Service (KMS).
8. 4.

   Validate encryption status: Check the SNS topic attributes to confirm that encryption has been enabled. Use the command mentioned in the "Necessary Codes" section, replacing

   <topic-arn>

   with the ARN of the SNS topic.

10. 5.

    Repeat steps 3-4 for all relevant SNS topics: Ensure that encryption at rest is enabled for all SNS topics that contain personal data subject to GDPR regulations.

12. 6.

    Monitor and maintain: Regularly monitor the encryption settings for SNS topics and ensure that they remain compliant with GDPR regulations. Make updates or changes as needed to adapt to evolving security requirements.