Why didn't my Amazon SNS topic deliver the messages I published to my Amazon SQS queue that has SSE activated?

Short description

Your Amazon SQS queue must use an AWS Key Management Service (AWS KMS) customer managed key. The customer managed key must include a custom key policy that gives Amazon SNS sufficient key usage permissions.

Note: The default key policy of the AWS managed key for Amazon SQS doesn't include the required permissions, and you can't modify this key's policy.

Resolution

Complete the following steps:

1. Create a new customer managed KMS key with a key policy that has the required permissions for Amazon SNS.
2. Use the custom KMS key that you just created to Configure SSE for your Amazon SQS queue.
3. If your Amazon SNS topic has SSE activated, then check your configuration requirements. Configure AWS KMS permissions that allow your publisher to publish messages to your encrypted topic.

For more information, see Setting up Amazon SNS topic encryption with encrypted Amazon SQS queue subscription.

Related information

Encrypting messages published to Amazon SNS with AWS KMS