Start from the Use-case

• I am trying to encrypt an SQS Queue using my own KMS key. This has been supported since SQS Server side encryption #138
• I need a Lambda function to be able to use that KMS key
• I also need to enable key rotation for compliance reasons

Example Config

No response

Implementation Idea

Any of these would solve my problem:

• Support existing keys: Use existing customer managed kms key #259
• Add the the key ARN created via encryptionKey as a CfOutput
• Auto-create a key alias with some documented format, e.g. alias/sqs/:queue-name