Why aren't messages that I publish to my Amazon SNS topic getting delivered to my subscribed Amazon SQS queue that has server-side encryption (SSE) enabled?

Last updated: 2020-11-19

Your Amazon SQS queue must use a customer master key (CMK) that is customer managed. This CMK must include a custom key policy that gives Amazon SNS sufficient key usage permissions.

Note: The required permissions aren't included in the default key policy of the AWS-managed CMK for Amazon SQS, and you can't modify this policy.

1. Create a new customer-managed CMK with a key policy that has the required permissions for Amazon SNS.
2. Configure SSE for your Amazon SQS queue using the custom CMK you just created.

For more information, see Enabling server-side encryption (SSE) for an Amazon SNS topic with an encrypted Amazon SQS queue subscribed.

Note: To troubleshoot other message delivery issues, see Amazon SNS message delivery status.