title: SQS can receive encrypted message from SNS with no specific KMS permission
body: <p>I am a new learner for AWS KMS (Key Management Service).</p>
  <p>Currently I want to create an SNS that server-side encryption (SSE) is enabled and publishes message to subscribing Amazon SQS queue.</p>
  <p>The Resource part of Cloudformation is like:
  (The CMK key and SNS Arn are not shown)</p>
  <pre><code>Resources:
    MySNSTopic: 
      Type: AWS::SNS::Topic
      Properties:  
        TopicName: !Ref TopicName 
        KmsMasterKeyId: (My_CMK_Key)
  
    MySQS:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: &quot;MySQS&quot;
        
    MySQSPermissions:
      Type: AWS::SQS::QueuePolicy
      Properties:
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Sid: MySQSPolicy
              Effect: Allow
              Principal: '*'
              Action:
                - sqs:SendMessage
              Resource: !GetAtt MySQS.Arn
              Condition:
                ArnEquals:
                  aws:SourceArn: (My_SNS_ARN)
        Queues:
          - !Ref MySQS
              
    MySQSSubscription:
      Type: AWS::SNS::Subscription
      Properties:
        Protocol: sqs
        Endpoint: !GetAtt MySQS.Arn
        Region: !Ref AWS::Region
        TopicArn: (My_SNS_ARN)
  </code></pre>
  <p>As you can see only SNS topic is with SSE enabled, but SQS is just subscribing the SNS topic.</p>
  <p>When I tried to publish message to the SNS topic. The SQS queue (MySQS) can receive message successfully but looks like its Body is not encrypted (still human-readable).</p>
  <pre><code>{
    &quot;Type&quot; : &quot;Notification&quot;,
    &quot;MessageId&quot; : (id),
    &quot;TopicArn&quot; : (Arn),
    &quot;Subject&quot; : &quot;The message from SNS topic&quot;,
    &quot;Message&quot; : &quot;The message should be encrypted&quot;, // Looks like it is not encrypted?
    &quot;Timestamp&quot; : &quot;....&quot;,
    &quot;SignatureVersion&quot; : &quot;1&quot;,
    &quot;Signature&quot; : (Signature string),
    &quot;SigningCertURL&quot; : (Signing URL),
    &quot;UnsubscribeURL&quot; :  (Unscribed URL)
  }
  </code></pre>
  <p>My questions are:</p>
  <ol>
  <li>How do I know the message from this SNS topic is encrypted?</li>
  <li>How the SQS queue receives the message (from SNS topic) that seems like not encrypted? The SQS queue in this case does not use the same CMK that used by the SNS topic, and also with no any KMS permission are specified.</li>
  <li>If I create a Lambda function to retrieve data from this SQS queue, does it require the CMK key? Or it can read the message successfully?</li>
  </ol>