Enforce Encryption on SNS creation by SCP


I would like to create an SCP to enforce encryption on SNS creation. I am creating the below policy but it failed.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Deny", "Action": [ "sns:CreateTopic" ], "Resource": "*", "Condition": { "StringNotEquals": { "KmsMasterKeyId": "alias/aws/sns" } } } ] }

1 Answer

Unfortunately I do not believe that the SNS service supports the KmsMasterKeyId as a conditional:
As such the policy will not work as the string will always "not equal" and then fail through the Deny.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions