Kinesis stream must use KMS encryption

High AWS General aws-kinesis-stream-encryption

Applies to

AWS::Kinesis::Stream

What CGPulse checks

A resource passes this rule when encryptionType must equal KMS. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable encryption at rest to protect stream data from media compromise. In AWS Console: Kinesis > Data streams > select stream > Edit > enable Server-side encryption. See: https://docs.aws.amazon.com/streams/latest/dev/server-side-encryption.html

CLI

aws kinesis start-stream-encryption --stream-name "{name}" --encryption-type KMS --key-id alias/aws/kinesis

Terraform

resource "aws_kinesis_stream" "{name}" {
  encryption_type = "KMS"
  kms_key_id      = aws_kms_key.{name}.id
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan