Using aws kms with queue

Question

Pulumi · Accepted Answer

Certainly! AWS KMS (Key Management Service) is a service that allows you to create and manage encryption keys that you can use to encrypt data. Amazon SQS (Simple Queue Service) supports the integration of AWS KMS for server-side encryption (SSE), allowing you to protect the messages in your queues.

In the Pulumi program below, I will demonstrate how to create a simple queue with AWS SQS, set up a KMS Key, and then configure the queue to use the KMS Key for encrypting messages. I will use the `aws` package as it provides high-level components that simplify resource creation and management in AWS.

Here's a step-by-step TypeScript program that sets up an SQS queue and uses an AWS KMS key to encrypt the messages in the queue:

1. **KMS Key Creation**: We create a KMS key that the SQS queue will use for encryption.
2. **SQS Queue Creation**: We create an SQS queue with encryption enabled, using the KMS key we created.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an AWS KMS Key for encrypting messages
const kmsKey = new aws.kms.Key("myKey", {
    description: "KMS Key for SQS message encryption", // Description of the KMS Key
    // Policy can be optionally defined to manage permissions for the KMS Key
});

// Create an SQS Queue with KMS encryption enabled
const queue = new aws.sqs.Queue("myQueue", {
    // The ID of an AWS-managed customer master key (CMK) for Amazon SQS or a custom CMK.
    // Here we reference the ID of the KMS Key we created above.
    kmsMasterKeyId: kmsKey.id,
    // Time in seconds for which to retain data keys used to encrypt and decrypt the queue messages. 
    // Optional parameter and can be between 60 (1 minute) and 86,400 (24 hours).
    kmsDataKeyReusePeriodSeconds: 300,
});

// Export the name and ARN of the queue and KMS Key
export const queueName = queue.name;
export const queueArn = queue.arn;
export const kmsKeyId = kmsKey.id;
export const kmsKeyArn = kmsKey.arn;

```

In this program:

- We use `aws.kms.Key` to define a new encryption key in AWS KMS. We give it a description for easier identification. It's important to note the key policy is crucial for access management, but for simplicity, I'm omitting it here.
- Next, we define an SQS queue with `aws.sqs.Queue`. We refer to the KMS key by its `id` in the `kmsMasterKeyId` property. The `kmsDataKeyReusePeriodSeconds` property is optional and controls the time that the data key can be reused to encrypt messages before a new data key must be generated.

Remember that when working with KMS, key permissions and policies are vital for security and access control. They should be defined accordingly based on your organization's security requirements.

After setting this up, any message that is sent to `myQueue` will be encrypted using the KMS key `myKey`. The encrypted messages are decrypted automatically for an authorized consumer on the receiving end.

For detailed information about the `aws.kms.Key` resource, you can refer to the [AWS KMS Key documentation](https://www.pulumi.com/docs/reference/pkg/aws/kms/key/), and for the `aws.sqs.Queue` resource, refer to the [AWS SQS Queue documentation](https://www.pulumi.com/docs/reference/pkg/aws/sqs/queue/).