AWS Security Hub - Detect SQS Queue lacking encryption at rest

Back


Id	7b8c5e2d-6f1c-4a1f-9e2a-3c5f7a8b9c10
Rulename	AWS Security Hub - Detect SQS Queue lacking encryption at rest
Description	This query detects Amazon SQS queues without server-side encryption at rest enabled, using AWS Security Hub control SQS.1 findings. Lack of encryption for SQS queues can expose sensitive message contents if underlying storage or backups are accessed by unauthorized parties.
Severity	Medium
Tactics	Impact
Techniques	T1565.001
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/SQSQueueNotEncrypted.yaml
Version	1.0.0
Arm template	7b8c5e2d-6f1c-4a1f-9e2a-3c5f7a8b9c10.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/SQS.1"
      or tostring(ComplianceSecurityControlId) == "SQS.1"
| mv-expand Resource = Resources
| where tostring(Resource.Type) == "AwsSqsQueue"
| extend QueueArn = tostring(Resource.Id)
| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, QueueArn

YAML

name: AWS Security Hub - Detect SQS Queue lacking encryption at rest
alertDetailsOverride:
  alertDisplayNameFormat: SQS queue {{QueueArn}} not encrypted at rest
  alertDescriptionFormat: AWS Account {{AwsAccountId}} has an SQS queue ({{QueueArn}}) without server-side encryption enabled. Enable KMS encryption to protect message data at rest.
id: 7b8c5e2d-6f1c-4a1f-9e2a-3c5f7a8b9c10
description: |
  This query detects Amazon SQS queues without server-side encryption at rest enabled, using AWS Security Hub control SQS.1 findings.
  Lack of encryption for SQS queues can expose sensitive message contents if underlying storage or backups are accessed by unauthorized parties.  
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AwsAccountId
    identifier: Name
  - columnName: AwsAccountId
    identifier: CloudAppAccountId
  entityType: Account
- fieldMappings:
  - columnName: QueueArn
    identifier: Name
  entityType: CloudApplication
version: 1.0.0
triggerOperator: gt
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/SQS.1"
        or tostring(ComplianceSecurityControlId) == "SQS.1"
  | mv-expand Resource = Resources
  | where tostring(Resource.Type) == "AwsSqsQueue"
  | extend QueueArn = tostring(Resource.Id)
  | summarize TimeGenerated = max(TimeGenerated)
      by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
         AwsSecurityFindingId, ComplianceSecurityControlId, QueueArn  
tactics:
- Impact
kind: Scheduled
queryFrequency: 1h
tags:
- AWS Foundational Security Best Practices v1.0.0
- NIST 800-53 r5
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/SQSQueueNotEncrypted.yaml
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - AWSSecurityHubFindings
  connectorId: AWSSecurityHub
status: Available
customDetails:
  FindingId: AwsSecurityFindingId
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
relevantTechniques:
- T1565.001

ARM