SNS topic not encrypted with CMK.
Default Severity: high
Explanation
Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.
Possible Impact
Key management very limited when using default keys.
Suggested Resolution
Use a CMK for SNS Topic encryption
Insecure Example
The following example will fail the aws-sns-topic-encryption-use-cmk check.
resource "aws_sns_topic" "bad_example" {
kms_master_key_id = "alias/aws/sns"
}
Secure Example
The following example will pass the aws-sns-topic-encryption-use-cmk check.
resource "aws_sns_topic" "good_example" {
kms_master_key_id = "/blah"
}