Unencrypted SQS queue
A queue with no server-side encryption and no dead-letter queue.
Press Run. The stack loaded here fails in a way worth seeing.
▸What the engine finds4 findings
Not examples — Unencrypted SQS queue was run through the real engine when this page was built, and this is what it returned.
With no redrive policy, a poison message retries forever.INTENT
No KmsMasterKeyId and no SQS-managed encryption on this queue.INTENT
▸ 2 informational findings — no dead-letter queue, queue does not
No dead-letter queueAwsSolutions-SQS3Jobs
With no dead-letter queue a message that always fails is retried forever, blocking the queue behind it.
Full rule text
The SQS queue is not used as a dead-letter queue (DLQ) and does not have a DLQ enabled. Using a DLQ helps maintain the queue flow and avoid losing data by detecting and mitigating failures and service disruptions on time. AwsSolutions-SQS3 guide →
Queue does not require SSLAwsSolutions-SQS4Jobs
The SQS queue does not require requests to use SSL. Without HTTPS (TLS), a network-based attacker can eavesdrop on network traffic or manipulate it, using an attack such as man-in-the-middle. Allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition in the queue policy to force requests to use SSL.
Full rule text
The SQS queue does not require requests to use SSL. Without HTTPS (TLS), a network-based attacker can eavesdrop on network traffic or manipulate it, using an attack such as man-in-the-middle. Allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition in the queue policy to force requests to use SSL.
Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.