title: Encrypted bucket notifications from S3 to SQS
body: <p>How can I set up S3 bucket notifications to a queue in SQS where KMS are used on both the bucket and the queue?</p>
  
  <ul>
  <li>I have a bucket in S3 where the contents are encrypted with an AWS Managed Key (the <code>aws/s3</code> default key).</li>
  <li>I have a queue in SQS where SSE (server-side encryption) is enabled, but using a CMK (Customer-Managed Key).</li>
  </ul>
  
  <p>When I go into the S3 web console and try adding a notification event on my bucket that sends to my queue in SQS, I am presented with this error message:</p>
  
  <blockquote>
    <p>Unable to validate the following destination configurations. The message to the SSE queue could not be encrypted using KMS. (arn:aws:sqs:ca-central-1: ... : ...)</p>
  </blockquote>
  
  <p>I've already tried configuring my KMS Key Policy to give the S3 service account the permissions it needs.</p>
  
  <pre><code>        {
              "Sid": "Let S3 encrypt messages so that bucket notifications can be encrypted",
              "Effect": "Allow",
              "Principal": {
                  "Service": "s3.amazonaws.com"
              },
              "Action": [
                  "kms:GenerateDataKey",
                  "kms:Encrypt"
              ],
              "Resource": "*"
          },
  </code></pre>
  
  <p>What do I need to do in order to allow bucket notifications onto an encrypted queue?</p>