Amazon SQS Key management

Amazon SQS integrates with the AWS Key Management Service (KMS) to manage KMS keys for server-side encryption (SSE). See Encryption at rest in Amazon SQS for SSE information and key management definitions. Amazon SQS uses KMS keys to validate and secure the data keys that encrypt and decrypt the messages. The following sections provide information about working with KMS keys and data keys in the Amazon SQS service.

Configuring AWS KMS permissions

Every KMS key must have a key policy. Note that you cannot modify the key policy of an AWS managed KMS key for Amazon SQS. The policy for this KMS key includes permissions for all principals in the account (that are authorized to use Amazon SQS) to use encrypted queues.

For a customer managed KMS key, you must configure the key policy to add permissions for each queue producer and consumer. To do this, you name the producer and consumer as users in the KMS key policy. For more information about AWS KMS permissions, see AWS KMS resources and operations or AWS KMS API permissions reference in the AWS Key Management Service Developer Guide.

Alternatively, you can specify the required permissions in an IAM policy assigned to the principals that produce and consume encrypted messages. For more information, see Using IAM Policies with AWS KMS in the AWS Key Management Service Developer Guide.

Configure KMS permissions for AWS services

Several AWS services act as event sources that can send events to Amazon SQS queues. To allow these event sources to work with encrypted queues, you must create a customer managed KMS key and add permissions in the key policy for the service to use the required AWS KMS API methods. Perform the following steps to configure the permissions.

Configure AWS KMS permissions for producers

When the data key reuse period expires, the producer's next call to SendMessage or SendMessageBatch also triggers calls to kms:Decrypt and kms:GenerateDataKey. The call to kms:Decrypt is to verify the integrity of the new data key before using it. Therefore, the producer must have the kms:Decrypt and kms:GenerateDataKey permissions for the KMS key.

Add the following statement to the IAM policy of the producer. Remember to use the correct ARN values for the key resource and the queue resource.

{
   "Version": "2012-10-17",
      "Statement": [{
         "Effect": "Allow",
         "Action": [
	     "kms:Decrypt",
         "kms:GenerateDataKey"
         ],
         "Resource":  "arn:aws:kms:us-east-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
         }, {
         "Effect": "Allow",
         "Action": [
            "sqs:SendMessage" 
         ],
         "Resource": "arn:aws:sqs:*:123456789012:MyQueue"
      }]
}

Configure AWS KMS permissions for consumers

When the data key reuse period expires, the consumer's next call to ReceiveMessage also triggers a call to kms:Decrypt, to verify the integrity of the new data key before using it. Therefore, the consumer must have the kms:Decrypt permission for any KMS key that is used to encrypt the messages in the specified queue. If the queue acts as a dead-letter queue, the consumer must also have the kms:Decrypt permission for any KMS key that is used to encrypt the messages in the source queue. Add the following statement to the IAM policy of the consumer. Remember to use the correct ARN values for the key resource and the queue resource.

{
   "Version": "2012-10-17",
      "Statement": [{
         "Effect": "Allow",
         "Action": [
            "kms:Decrypt"
         ],
         "Resource": "arn:aws:kms:us-east-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
         }, {
         "Effect": "Allow",
         "Action": [
            "sqs:ReceiveMessage"
         ],
         "Resource": "arn:aws:sqs:*:123456789012:MyQueue"
      }]
}

Configure AWS KMS permissions with confused deputy protection

When the principal in a key policy statement is an AWS service principal, you can use the aws:SourceArn or aws:SourceAccount global condition keys to protect against the confused deputy scenario. To use these condition keys, set the value to the Amazon Resource Name (ARN) of the resource that is being encrypted. If you don't know the ARN of the resource, use aws:SourceAccount instead.

In this KMS key policy, a specific resource from service that is owned by account 111122223333 is allowed to call KMS for Decrypt and GenerateDataKey actions, which occur during SSE usage of Amazon SQS.

{
	"Version": "2012-10-17",
	"Statement": [{
		"Effect": "Allow",
		"Principal": {
            "Service": "<replaceable>service</replaceable>.amazonaws.com"
		},
		"Action": [
			"kms:GenerateDataKey",
			"kms:Decrypt"
		],
		"Resource": "*",
		"Condition": {
			"ArnEquals": {
				"aws:SourceArn": [
					"arn:aws:service::111122223333:resource"
				]
			}
		}
	}]
}

When using SSE enabled Amazon SQS queues, the following services support aws:SourceArn:

Understanding the data key reuse period

The data key reuse period defines the maximum duration for Amazon SQS to reuse the same data key. When the data key reuse period ends, Amazon SQS generates a new data key. Note the following guidelines about the reuse period.

Estimating AWS KMS costs

To predict costs and better understand your AWS bill, you might want to know how often Amazon SQS uses your KMS key.

To calculate the number of API requests (R) per queue, use the following formula:

R = (B / D) * (2 * P + C)

B is the billing period (in seconds).

D is the data key reuse period (in seconds).

P is the number of producing principals that send to the Amazon SQS queue.

C is the number of consuming principals that receive from the Amazon SQS queue.

The following are example calculations. For exact pricing information, see AWS Key Management Service Pricing.

Example 1: Calculating the number of AWS KMS API calls for 2 principals and 1 queue

This example assumes the following:

(2,678,400 / 300) * (2 * 1 + 1) = 26,784

Example 2: Calculating the number of AWS KMS API calls for multiple producers and consumers and 2 queues

This example assumes the following:

(2,419,200 / 86,400 * (2 * 3 + 1)) + (2,419,200 / 86,400 * (2 * 5 + 2)) = 532

AWS KMS errors

When you work with Amazon SQS and AWS KMS, you might encounter errors. The following references describe the errors and possible troubleshooting solutions.