title: how to deny create sqs queue permission to all users if the queue is not encrypted
body: <p>I am trying to &quot;Deny&quot; create sqs queue (<code>sqs:CreateQueue</code>) permission for all user if they forgot to encrypt the queue while creating. I tried with the below policy but still the policy is allowing the user to create queue if they are encrypting or not.</p>
  <pre><code> {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;denysqsifnotencrypted&quot;,
        &quot;Action&quot;: &quot;sqs:CreateQueue&quot;,
        &quot;Effect&quot;: &quot;Deny&quot;,
        &quot;Resource&quot;: &quot;*&quot;,
         &quot;Condition&quot;: {
             &quot;ForAnyValue:StringNotEquals&quot;: {
              &quot;aws:CalledVia&quot;: [&quot;kms.amazonaws.com&quot;]
              }
          }
      }
    ]
  }
  </code></pre>