Data Key Recycling for SQS

Question

I need to use recycle keys for SQS. When I recycle the key, both producer and consumer will use same key as per documentation. The calls to SendMessage and ReceiveMessage will each trigger a call to AWS KMS Decrypt to verify the integrity of the data key before using it. This works only if the messages are ordered i.e. Fifo queues. If I am using standard queues, this will not work as the messages may be out of order. Can you  clarify.

Answer

I think it will work. Look at this documentation:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-server-side-encryption.html

SQS uses "Envelop Encryption": It describes the fact that every message is stored with it encrypted data key with it.

That way in- or out-of-order messages will not matter in case of rotation.

Data Key Recycling for SQS

Relevant content