fix(sqs): reconcile SqsManagedSseEnabled when KmsMasterKeyId is set#13780
Open
mcrolly wants to merge 1 commit intolocalstack:mainfrom
Open
fix(sqs): reconcile SqsManagedSseEnabled when KmsMasterKeyId is set#13780mcrolly wants to merge 1 commit intolocalstack:mainfrom
mcrolly wants to merge 1 commit intolocalstack:mainfrom
Conversation
Fixes localstack#13539 On AWS, KmsMasterKeyId and SqsManagedSseEnabled are mutually exclusive: - When KmsMasterKeyId is set, SqsManagedSseEnabled becomes 'false' - When KmsMasterKeyId is removed, SqsManagedSseEnabled reverts to 'true' LocalStack was not reconciling these attributes, causing SqsManagedSseEnabled to remain 'true' even when KMS encryption was configured. This broke terraform-provider-aws encryption tests. Changes: - Add _reconcile_sse_attributes() to SqsQueue model - Call it on queue creation (when attributes include KmsMasterKeyId) - Call it from set_queue_attributes when KmsMasterKeyId is modified - Remove skip_snapshot_verify for SqsManagedSseEnabled in test_set_queue_attributes_default_values (now passes correctly)
Contributor
|
All contributors have signed the CLA ✍️ ✅ |
Contributor
localstack-bot
left a comment
There was a problem hiding this comment.
Welcome to LocalStack! Thanks for raising your first Pull Request and landing in your contributions. Our team will reach out with any reviews or feedbacks that we have shortly. We recommend joining our Slack Community and share your PR on the #community channel to share your contributions with us. Please make sure you are following our contributing guidelines and our Code of Conduct.
Author
|
I have read the CLA Document and I hereby sign the CLA |
localstack-bot
added a commit
that referenced
this pull request
Feb 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Fixes #13539
On AWS,
KmsMasterKeyIdandSqsManagedSseEnabledare mutually exclusive encryption modes:KmsMasterKeyIdis set →SqsManagedSseEnabledbecomes"false"KmsMasterKeyIdis removed →SqsManagedSseEnabledreverts to"true"LocalStack was not reconciling these, so
SqsManagedSseEnabledremained"true"even when KMS encryption was configured. This causedterraform-provider-awsSQS encryption tests to fail and produced incorrect snapshot diffs.Changes
models.py: Added_reconcile_sse_attributes()method toSqsQueuethat ensures mutual exclusivity between KMS and SQS-managed SSE. Called during queue creation when attributes includeKmsMasterKeyId.provider.py: Call_reconcile_sse_attributes()inset_queue_attributeswhenKmsMasterKeyIdis modified, handling both setting and removing KMS keys.test_sqs.py: Removedskip_snapshot_verifyforSqsManagedSseEnabledontest_set_queue_attributes_default_valuessince the fix makes the snapshot match correctly.Tests
KmsMasterKeyId→SqsManagedSseEnabledis"false"SqsManagedSseEnabledis"true"(default)SetQueueAttributeswithKmsMasterKeyIdflipsSqsManagedSseEnabledto"false"KmsMasterKeyIdrestoresSqsManagedSseEnabledto"true"test_set_queue_attributes_default_valuesshould now pass without skipRelated
terraform-provider-awstest:TestAccSQSQueue_encryption