Control: 1 Kinesis Data Streams should be encrypted at rest
Description
This control checks if Kinesis Data Streams are encrypted at rest with server-side encryption. This control fails if a Kinesis stream is not encrypted at rest with server-side encryption.
Server-side encryption is a feature in Amazon Kinesis Data Streams that automatically encrypts data before it's at rest by using an AWS KMS key. Data is encrypted before it's written to the Kinesis stream storage layer, and decrypted after it’s retrieved from storage. As a result, your data is encrypted at rest within the Amazon Kinesis Data Streams service.
Remediation
For information about enabling server-side encryption for Kinesis streams, see How Do I Get Started with Server-Side Encryption? in the Amazon Kinesis Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_kinesis_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_kinesis_1 --shareSQL
This control uses a named query:
kinesis_stream_server_side_encryption_enabled