(sqs): add SSE queue encryption for SQS

Description

Currently you can only only select the following queue encryptions:

• UNENCRYPTED
• KMS_MANAGED
• KMS

However, via AWS Console you can also select SSE encryption.

Use Case

We use S3 events, that are automatically forwarded to SQS, but that doesn’t work with KMS encryption, but it does with SSE (we tried this via AWS console).

Proposed Solution

Add a new option SSE to QueueEncryption: https://github.com/aws/aws-cdk/blob/29039e8bd13a4fdb7f84254038b3331c179273fd/packages/%40aws-cdk/aws-sqs/lib/queue.ts#L192

Other information

No response

Acknowledge

• I may be able to implement this feature request
• This feature might incur a breaking change

[a-h]

I’d also like to propose that SSE becomes the default for queues, and that queues that don’t have KMS encryption enabled, get it enabled by default after the rollout.

This affects me because at present, the deadLetterQueueEnabled field on AWS Lambda creates an SQS queue. That queue is then not encrypted, which (depending on your use case) could lead to personal data being stored unencrypted at rest.

Any Lambda functions that use this behaviour will have their DLQs show up in AWS Security Hub because they don’t have encryption at rest enabled.

[danilobuerger]

Seems to be documented now: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-sqs-queue.html#cfn-sqs-queue-sqsmanagedsseenabled