Kinesis stream meets the minimum data retention period

Check ID: kinesis_stream_data_retention_period
Provider: AWS
Service: kinesis
Severity: MEDIUM
Categories: resilience
Resource type: AwsKinesisStream

What this check verifies

Kinesis Data Streams retention window is evaluated to confirm records are kept for at least the configured minimum duration (default 168 hours).

Risk

Insufficient retention causes records to expire before consumers read or reprocess them, undermining availability and analytics integrity. Backlogs or outages can create irreversible data gaps, hinder investigations and recovery, and enable denial-of-service-by-lag against event pipelines.

Recommendation

Set the retention period to exceed worst-case consumer lag, replay needs, and compliance windows; use at least 168 hours by default (or customize as necessary) and raise as required. Enforce change control and least privilege on retention changes, monitor consumer lag, and maintain secondary durability (e.g., archival) for critical streams.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kinesis increase-stream-retention-period —stream-name <example_resource_name> —retention-period-hours 168

# Kinesis stream with adequate retention period
resource "aws_kinesis_stream" "<example_resource_name>" {
  name             = "<example_resource_name>"
  shard_count      = 1
  retention_period = 168  # critical: sets retention to >= 168 hours to pass the check
}

# CloudFormation: set Kinesis stream retention to minimum required hours
Resources:
  <example_resource_name>:
    Type: AWS::Kinesis::Stream
    Properties:
      ShardCount: 1
      RetentionPeriodHours: 168  # critical: sets retention to >= 168 hours to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kinesis_stream_data_retention_period. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

MSK Connect connector has encryption in transit enabled Kinesis stream is encrypted at rest with KMS

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires