All checks
Medium
Kinesis streams should be encrypted at rest
Checks that Kinesis data streams use server-side encryption with an AWS KMS key, so records are encrypted before they are written to the stream's storage layer. Only records written after it is enabled are encrypted; records already in the stream stay unencrypted until they pass the retention period.
- service
- Kinesis
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: With a customer managed key, producers need kms:GenerateDataKey and consumers kms:Decrypt on it, or their writes and reads fail.
In the console
Kinesis → Data streams → the stream → Configuration → Server-side encryption
- Server-side encryption
- Enabled
- KMS master key
- (Default) aws/kinesis, or a customer managed key the producers and consumers can use
With the AWS CLI
aws kinesis start-stream-encryption --stream-name <stream-name> --encryption-type KMS --key-id alias/aws/kinesis --region <region>With Terraform
resource "aws_kinesis_stream" "this" {
name = var.stream_name
encryption_type = "KMS"
kms_key_id = "alias/aws/kinesis"
}See which of your accounts this check is failing on.
Book a live scan