Control: Kinesis firehose delivery streams should have server side encryption enabled

Description

Enable server side encryption (SSE) of your Kinesis firehose delivery stream, in order to protect your data and metadata from breaches or unauthorized access, and fulfill compliance requirements for data-at-rest encryption within your organization.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.kinesis_firehose_delivery_stream_server_side_encryption_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.kinesis_firehose_delivery_stream_server_side_encryption_enabled --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when delivery_stream_encryption_configuration ->> 'Status' = 'ENABLED' then 'ok'
    else 'alarm'
  end as status,
  case
    when delivery_stream_encryption_configuration ->> 'Status' = 'ENABLED' then title || ' server side encryption enabled.'
    else title || ' server side encryption disabled.'
  end as reason
  
  , region, account_id
from
  aws_kinesis_firehose_delivery_stream;

Control: Kinesis firehose delivery streams should have server side encryption enabled

Description

Usage

SQL

Tags