Firehose delivery streams should be encrypted at rest

How to fix it

• Can break clients: With a customer managed key, PutRecord callers need kms:GenerateDataKey and kms:Decrypt on it, and records Firehose cannot decrypt for 24 hours are discarded.
• Affects another check: A stream reading from a Kinesis data stream cannot enable this, so set Server-side encryption to Enabled on that source stream instead, which clears this check and Kinesis.1 together.

In the console

Amazon Data Firehose → the Firehose stream → Configuration → Server-side encryption (SSE)

Server-side encryption (SSE)

Enable server-side encryption for source records in Firehose stream

Encryption type

AWS owned key, or a customer managed key Firehose can use

With the AWS CLI

aws firehose start-delivery-stream-encryption --delivery-stream-name <stream-name> --delivery-stream-encryption-configuration-input KeyType=AWS_OWNED_CMK --region <region>

With Terraform

resource "aws_kinesis_firehose_delivery_stream" "this" {
  name        = var.stream_name
  destination = var.destination

  server_side_encryption {
    enabled  = true
    key_type = "AWS_OWNED_CMK"
  }
}