How does server-side encryption work for Amazon SQS queues?
Show answer and explanation
Answer: B
SQS server-side encryption wraps message bodies with a KMS data key before they are written to the queue's storage. You can use the AWS managed key aws/sqs or a customer managed key, and the encrypt and decrypt steps are invisible to producers and consumers. Access to the key is governed by KMS policy, so revoking key permissions also blocks reads of queued messages.
Why the other options are wrong
- A. SQS supports SSE with KMS, so saying it has no encryption support is wrong.
- C. Client-side encryption can be added by the application, but server-side encryption with KMS is also available.
- D. SSE for SQS is KMS-based; the key policy and grants are part of the control surface.