Find SQS Queues and SNS Topics Without Encryption Enabled

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadQueuesAndTopics",
      "Effect": "Allow",
      "Action": [
        "sqs:ListQueues",
        "sqs:GetQueueAttributes",
        "sns:ListTopics",
        "sns:GetTopicAttributes"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EnableSseSqsOnlyWithApply",
      "Effect": "Allow",
      "Action": "sqs:SetQueueAttributes",
      "Resource": "arn:aws:sqs:*:123456789012:*"
    }
  ]
}

// find-unencrypted-sqs-queues-and-sns-topics.ts
// Lists SQS queues and SNS topics in each Region with their server-side encryption setting.
// Report only by default. With --apply, turns on SSE-SQS for queues that have no encryption at all.
// SNS topics are never changed: they need a KMS key you choose and a key policy you write.
// Usage:
//   npx tsx find-unencrypted-sqs-queues-and-sns-topics.ts [--regions us-east-1,eu-west-1] [--csv sse.csv] [--apply]
import { writeFileSync } from "node:fs";
import { GetQueueAttributesCommand, SetQueueAttributesCommand, SQSClient, paginateListQueues } from "@aws-sdk/client-sqs";
import { GetTopicAttributesCommand, SNSClient, paginateListTopics } from "@aws-sdk/client-sns";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const apply = args.includes("--apply");
const csvPath = flag("--csv");
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1")
  .split(",")
  .map((r) => r.trim())
  .filter(Boolean);

interface Row {
  Region: string;
  Type: "SQS" | "SNS";
  Name: string;
  Encryption: string;
  Finding: string;
}

// SSE-KMS with the AWS managed key works for your own producers, but AWS services such as S3 event
// notifications or EventBridge need a customer managed key whose policy names them.
function describeKey(keyId: string, awsManagedAlias: string): { enc: string; finding: string } {
  if (keyId === awsManagedAlias) {
    return { enc: `SSE-KMS (${awsManagedAlias})`, finding: "ok; AWS service publishers need a customer managed key" };
  }
  return { enc: "SSE-KMS (customer key)", finding: "ok" };
}

async function scanQueues(region: string): Promise<Row[]> {
  const sqs = new SQSClient({ region });
  const rows: Row[] = [];
  for await (const page of paginateListQueues({ client: sqs }, {})) {
    for (const url of page.QueueUrls ?? []) {
      const name = url.split("/").pop() ?? url;
      const { Attributes: a = {} } = await sqs.send(
        new GetQueueAttributesCommand({ QueueUrl: url, AttributeNames: ["SqsManagedSseEnabled", "KmsMasterKeyId"] }),
      );
      if (a.KmsMasterKeyId) {
        rows.push({ Region: region, Type: "SQS", Name: name, ...toRow(describeKey(a.KmsMasterKeyId, "alias/aws/sqs")) });
      } else if (a.SqsManagedSseEnabled === "true") {
        rows.push({ Region: region, Type: "SQS", Name: name, Encryption: "SSE-SQS", Finding: "ok" });
      } else {
        let finding = "NOT ENCRYPTED";
        if (apply) {
          await sqs.send(new SetQueueAttributesCommand({ QueueUrl: url, Attributes: { SqsManagedSseEnabled: "true" } }));
          finding = "NOT ENCRYPTED -> SSE-SQS enabled";
        }
        rows.push({ Region: region, Type: "SQS", Name: name, Encryption: "none", Finding: finding });
      }
    }
  }
  return rows;
}

async function scanTopics(region: string): Promise<Row[]> {
  const sns = new SNSClient({ region });
  const rows: Row[] = [];
  for await (const page of paginateListTopics({ client: sns }, {})) {
    for (const topic of page.Topics ?? []) {
      const arn = topic.TopicArn ?? "";
      const { Attributes: a = {} } = await sns.send(new GetTopicAttributesCommand({ TopicArn: arn }));
      const name = arn.split(":").pop() ?? arn;
      if (a.KmsMasterKeyId) {
        rows.push({ Region: region, Type: "SNS", Name: name, ...toRow(describeKey(a.KmsMasterKeyId, "alias/aws/sns")) });
      } else {
        rows.push({ Region: region, Type: "SNS", Name: name, Encryption: "none", Finding: "NOT ENCRYPTED (fix manually)" });
      }
    }
  }
  return rows;
}

function toRow(r: { enc: string; finding: string }): { Encryption: string; Finding: string } {
  return { Encryption: r.enc, Finding: r.finding };
}

function toCsv(rows: Row[]): string {
  const cols = Object.keys(rows[0] ?? {}) as (keyof Row)[];
  const cell = (v: string) => `"${v.replace(/"/g, '""')}"`;
  return [cols.join(","), ...rows.map((r) => cols.map((c) => cell(r[c])).join(","))].join("\n") + "\n";
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of regions) {
    for (const scan of [scanQueues, scanTopics]) {
      try {
        rows.push(...(await scan(region)));
      } catch (err) {
        console.error(`${region} ${scan.name}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
      }
    }
  }
  const findings = rows.filter((r) => r.Finding !== "ok");
  if (findings.length) console.table(findings);
  const none = rows.filter((r) => r.Encryption === "none");
  console.log(`${rows.length} queues and topics checked, ${none.length} without encryption`);
  if (csvPath && rows.length) {
    writeFileSync(csvPath, toCsv(rows));
    console.log(`Wrote ${rows.length} rows to ${csvPath}`);
  }
  console.log(apply ? "Applied SSE-SQS to unencrypted queues only. Topics were not changed." : "Report only: nothing was modified. Add --apply to enable SSE-SQS on unencrypted queues.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-sqs @aws-sdk/client-sns
npm install --save-dev tsx typescript @types/node

# Report for two Regions
AWS_PROFILE=readonly npx tsx find-unencrypted-sqs-queues-and-sns-topics.ts --regions us-east-1,eu-west-1 --csv sse.csv

# Turn on SSE-SQS for unencrypted queues in one Region
AWS_PROFILE=ops npx tsx find-unencrypted-sqs-queues-and-sns-topics.ts --regions us-east-1 --apply

┌─────────┬─────────────┬───────┬────────────────────┬───────────────────────────┬──────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Type  │ Name               │ Encryption                │ Finding                                                  │
├─────────┼─────────────┼───────┼────────────────────┼───────────────────────────┼──────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'SQS' │ 'orders-2019'      │ 'none'                    │ 'NOT ENCRYPTED'                                          │
│ 1       │ 'us-east-1' │ 'SQS' │ 's3-upload-events' │ 'SSE-KMS (alias/aws/sqs)' │ 'ok; AWS service publishers need a customer managed key' │
│ 2       │ 'us-east-1' │ 'SNS' │ 'billing-alarms'   │ 'none'                    │ 'NOT ENCRYPTED (fix manually)'                           │
│ 3       │ 'eu-west-1' │ 'SNS' │ 'deploy-events'    │ 'SSE-KMS (alias/aws/sns)' │ 'ok; AWS service publishers need a customer managed key' │
└─────────┴─────────────┴───────┴────────────────────┴───────────────────────────┴──────────────────────────────────────────────────────────┘
37 queues and topics checked, 2 without encryption
Wrote 37 rows to sse.csv
Report only: nothing was modified. Add --apply to enable SSE-SQS on unencrypted queues.