diff --git a/en/aws/sqs/sqs-encrypted.md b/en/aws/sqs/sqs-encryption-enabled.md similarity index 74% rename from en/aws/sqs/sqs-encrypted.md rename to en/aws/sqs/sqs-encryption-enabled.md index 60edfa056..6519fcd7f 100644 --- a/en/aws/sqs/sqs-encrypted.md +++ b/en/aws/sqs/sqs-encryption-enabled.md @@ -1,35 +1,35 @@ [![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com) -# AWS / SQS / SQS Encrypted +# AWS / SQS / SQS Encryption Enabled ## Quick Info | | | |-|-| -| **Plugin Title** | SQS Encrypted | +| **Plugin Title** | SQS Encryption Enabled | | **Cloud** | AWS | | **Category** | SQS | | **Description** | Ensures SQS encryption is enabled | | **More Info** | Messages sent to SQS queues can be encrypted using KMS server-side encryption. Existing queues can be modified to add encryption with minimal overhead. | | **AWS Link** | http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html | -| **Recommended Action** | Enable encryption using KMS for all SQS queues. | +| **Recommended Action** | Enable encryption using KMS Customer Master Keys (CMKs) for all SQS queues. | ## Detailed Remediation Steps 1. Log in to the AWS Management Console. -2. Select the "Services" option and search for SQS.
-3. Select the "SQS" queue that needs to be verified and click on its "Name".
-4. Scroll down the page and click on the "Encryption" tab from the bottom panel.
-5. Check the "Server Side Encryption" status for the selected "SQS" queue. If the "Server Side Encryption" is not configured then the following message is displayed "No server-side encryption is set for this queue". SSE protects the content of messages in Amazon SQS queues using keys managed in the AWS Key Management Service (AWS KMS)".
+2. Select the "Services" option and search for SQS.
+3. Select the "SQS" queue that needs to be verified and click on its "Name".
+4. Scroll down the page and click on the "Encryption" tab from the bottom panel.
+5. Check the "Server Side Encryption" status for the selected "SQS" queue. If the "Server Side Encryption" is not configured then the following message is displayed "No server-side encryption is set for this queue". SSE protects the content of messages in Amazon SQS queues using keys managed in the AWS Key Management Service (AWS KMS)".
6. Repeat step number 2 - 5 to verify other "SQS" queue in the selected AWS region.
-7. To enable the "SQS" encryption navigate to KMS services to create a "KMS CMK customer-managed key".
-8. Scroll down the left navigation panel and choose "Customer managed keys" under "Key Management Service" and click on the "Create key" button at the top panel.
-9. On the "Configure key" page select key type as "Symmetric". In the advanced options select "Key material origin" as "KMS" and "Regionality" as "Single-Region key" and proceed by clicking "Next" button.
-10. On the "Add labels" page provide the "Alias" and "Description" for the new "KMS key" and click on the "Next" button. You can define unique tags for "Tag key", "Tag value" under the "Tags" section.
-11. On the "Define key administrative permissions" page select the "IAM users" and roles who can administer the new "KMS key" through the KMS API and click "Next" button.
-12. On the "Define key usage permissions" page select the IAM users and roles that can use the CMK to encrypt and decrypt SQS data with the "AWS KMS API" and click on the "Next" button.
-13. On the "Review" page review the policy and click on the "Finish" button to create a new "KMS key" which can be used to encrypt/decrypt the SQS data.
-14. Now "KMS CMK customer-managed key" is created navigate to SQS and select the "SQS" queue which needs to be modified and click the "Edit" button at the top.
-15. On the "Edit TestQueue" page scroll down to "Encryption" and under the "Server-Side Encryption" select "Enabled".
-16. Under the "Encryption key type" select "AWS Key Management Service key (SSE-KMS)" and from the dropdown under "Customer master key" select the key that you have created for SQS.
-17. Click on the "Save" button to make the necessary changes.
-18. Repeat step number 7 - 17 to enable encryption using KMS for all SQS queues.
+7. To enable the "SQS" encryption navigate to KMS services to create a "KMS CMK customer-managed key".
+8. Scroll down the left navigation panel and choose "Customer managed keys" under "Key Management Service" and click on the "Create key" button at the top panel.
+9. On the "Configure key" page select key type as "Symmetric". In the advanced options select "Key material origin" as "KMS" and "Regionality" as "Single-Region key" and proceed by clicking "Next" button.
+10. On the "Add labels" page provide the "Alias" and "Description" for the new "KMS key" and click on the "Next" button. You can define unique tags for "Tag key", "Tag value" under the "Tags" section.
+11. On the "Define key administrative permissions" page select the "IAM users" and roles who can administer the new "KMS key" through the KMS API and click "Next" button.
+12. On the "Define key usage permissions" page select the IAM users and roles that can use the CMK to encrypt and decrypt SQS data with the "AWS KMS API" and click on the "Next" button.
+13. On the "Review" page review the policy and click on the "Finish" button to create a new "KMS key" which can be used to encrypt/decrypt the SQS data.
+14. Now "KMS CMK customer-managed key" is created navigate to SQS and select the "SQS" queue which needs to be modified and click the "Edit" button at the top.
+15. On the "Edit TestQueue" page scroll down to "Encryption" and under the "Server-Side Encryption" select "Enabled".
+16. Under the "Encryption key type" select "AWS Key Management Service key (SSE-KMS)" and from the dropdown under "Customer master key" select the key that you have created for SQS.
+17. Click on the "Save" button to make the necessary changes.
+18. Repeat step number 7 - 17 to enable encryption using KMS for all SQS queues.
\ No newline at end of file diff --git a/resources/aws/sqs/sqs-encrypted/README.md b/resources/aws/sqs/sqs-encryption-enabled/README.md similarity index 100% rename from resources/aws/sqs/sqs-encrypted/README.md rename to resources/aws/sqs/sqs-encryption-enabled/README.md diff --git a/resources/aws/sqs/sqs-encrypted/step10.png b/resources/aws/sqs/sqs-encryption-enabled/step10.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step10.png rename to resources/aws/sqs/sqs-encryption-enabled/step10.png diff --git a/resources/aws/sqs/sqs-encrypted/step11.png b/resources/aws/sqs/sqs-encryption-enabled/step11.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step11.png rename to resources/aws/sqs/sqs-encryption-enabled/step11.png diff --git a/resources/aws/sqs/sqs-encrypted/step12.png b/resources/aws/sqs/sqs-encryption-enabled/step12.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step12.png rename to resources/aws/sqs/sqs-encryption-enabled/step12.png diff --git a/resources/aws/sqs/sqs-encrypted/step13.png b/resources/aws/sqs/sqs-encryption-enabled/step13.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step13.png rename to resources/aws/sqs/sqs-encryption-enabled/step13.png diff --git a/resources/aws/sqs/sqs-encrypted/step14.png b/resources/aws/sqs/sqs-encryption-enabled/step14.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step14.png rename to resources/aws/sqs/sqs-encryption-enabled/step14.png diff --git a/resources/aws/sqs/sqs-encrypted/step15.png b/resources/aws/sqs/sqs-encryption-enabled/step15.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step15.png rename to resources/aws/sqs/sqs-encryption-enabled/step15.png diff --git a/resources/aws/sqs/sqs-encrypted/step16.png b/resources/aws/sqs/sqs-encryption-enabled/step16.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step16.png rename to resources/aws/sqs/sqs-encryption-enabled/step16.png diff --git a/resources/aws/sqs/sqs-encrypted/step17.png b/resources/aws/sqs/sqs-encryption-enabled/step17.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step17.png rename to resources/aws/sqs/sqs-encryption-enabled/step17.png diff --git a/resources/aws/sqs/sqs-encrypted/step2.png b/resources/aws/sqs/sqs-encryption-enabled/step2.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step2.png rename to resources/aws/sqs/sqs-encryption-enabled/step2.png diff --git a/resources/aws/sqs/sqs-encrypted/step3.png b/resources/aws/sqs/sqs-encryption-enabled/step3.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step3.png rename to resources/aws/sqs/sqs-encryption-enabled/step3.png diff --git a/resources/aws/sqs/sqs-encrypted/step4.png b/resources/aws/sqs/sqs-encryption-enabled/step4.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step4.png rename to resources/aws/sqs/sqs-encryption-enabled/step4.png diff --git a/resources/aws/sqs/sqs-encrypted/step5.png b/resources/aws/sqs/sqs-encryption-enabled/step5.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step5.png rename to resources/aws/sqs/sqs-encryption-enabled/step5.png diff --git a/resources/aws/sqs/sqs-encrypted/step7.png b/resources/aws/sqs/sqs-encryption-enabled/step7.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step7.png rename to resources/aws/sqs/sqs-encryption-enabled/step7.png diff --git a/resources/aws/sqs/sqs-encrypted/step8.png b/resources/aws/sqs/sqs-encryption-enabled/step8.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step8.png rename to resources/aws/sqs/sqs-encryption-enabled/step8.png diff --git a/resources/aws/sqs/sqs-encrypted/step9.png b/resources/aws/sqs/sqs-encryption-enabled/step9.png similarity index 100% rename from resources/aws/sqs/sqs-encrypted/step9.png rename to resources/aws/sqs/sqs-encryption-enabled/step9.png