Kinesis Data Firehose delivery stream is encrypted at rest

Check ID: firehose_stream_encrypted_at_rest
Provider: AWS
Service: firehose
Severity: MEDIUM
Categories: encryption
Resource type: AwsKinesisStream

What this check verifies

Amazon Data Firehose delivery streams must enable server-side encryption at rest with AWS KMS regardless of the source type. Encryption of upstream sources such as Kinesis Data Streams or MSK does not replace the need to protect the delivery stream itself.

Risk

Unencrypted Firehose data at rest can be read if storage or backups are accessed, harming confidentiality and integrity. Disk-level access, snapshots, or misconfigured destinations enable data exfiltration or tampering. Lacking KMS-backed controls also reduces key rotation, segregation of duties, and auditability.

Recommendation

Enable server-side encryption for Firehose with AWS KMS. Prefer customer managed keys (CMEK) to enforce least privilege, rotation, and auditing. Ensure upstream Kinesis sources are encrypted and confirm MSK defaults meet policy. Monitor KMS health signals and deny writes without encryption. Apply defense in depth at destinations.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws firehose start-delivery-stream-encryption --delivery-stream-name <delivery-stream-name> --delivery-stream-encryption-configuration-input KeyType=AWS_OWNED_CMK

# Terraform: Enable at-rest encryption for a Firehose delivery stream
resource "aws_kinesis_firehose_delivery_stream" "<example_resource_name>" {
  name        = "<example_resource_name>"
  destination = "extended_s3"

  server_side_encryption {
    enabled = true  # critical: turns on SSE at rest (uses AWS owned KMS key by default)
  }

  extended_s3_configuration {
    role_arn   = "arn:aws:iam::<example_account_id>:role/<example_resource_name>"
    bucket_arn = "arn:aws:s3:::<example_resource_name>"
  }
}

# CloudFormation: Enable at-rest encryption for a Firehose delivery stream
Resources:
  <example_resource_name>:
    Type: AWS::KinesisFirehose::DeliveryStream
    Properties:
      DeliveryStreamEncryptionConfigurationInput:
        KeyType: AWS_OWNED_CMK  # critical: enables SSE at rest using AWS owned KMS key
      ExtendedS3DestinationConfiguration:
        BucketARN: arn:aws:s3:::<example_resource_name>
        RoleARN: arn:aws:iam::<example_account_id>:role/<example_resource_name>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = firehose_stream_encrypted_at_rest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS EventBridge schema registry blocks cross-account access All AWS FMS policies are compliant for all accounts

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires