Kinesis stream is encrypted at rest with KMS

Check ID: kinesis_stream_encrypted_at_rest
Provider: AWS
Service: kinesis
Severity: HIGH
Categories: encryption
Resource type: AwsKinesisStream

What this check verifies

Amazon Kinesis Data Streams with server-side encryption use AWS KMS to protect records at rest. The evaluation determines whether a stream has SSE-KMS configured with a KMS key; streams lacking KMS-based at rest encryption are identified.

Risk

Without SSE-KMS, records in shards may be exposed in plaintext if storage, backups, or analytics exports are accessed, undermining confidentiality. Absence of KMS controls also reduces integrity and oversight by removing key policies, rotation, and audit trails-enabling covert data exfiltration or insider misuse.

Recommendation

Enable SSE-KMS on all streams.

Use customer-managed keys for rotation and ownership
Enforce least privilege on KMS grants; limit cross-account use
Monitor key usage and require encryption in CI/CD

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kinesis start-stream-encryption —stream-name <KINESIS_STREAM_NAME> —encryption-type KMS —key-id alias/aws/kinesis

# Enable KMS encryption on a Kinesis stream
resource "aws_kinesis_stream" "<example_resource_name>" {
  name            = "<example_resource_name>"
  shard_count     = 1
  encryption_type = "KMS"            # Critical: enables KMS encryption at rest
  kms_key_id      = "alias/aws/kinesis" # Critical: uses AWS managed Kinesis KMS key
}

# CloudFormation: enable KMS encryption on a Kinesis stream
Resources:
  <example_resource_name>:
    Type: AWS::Kinesis::Stream
    Properties:
      ShardCount: 1
      StreamEncryption:
        EncryptionType: KMS  # Critical: enables KMS encryption at rest
        KeyId: alias/aws/kinesis  # Critical: uses AWS managed Kinesis KMS key

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kinesis_stream_encrypted_at_rest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kinesis stream meets the minimum data retention period KMS customer-managed key is enabled or pending deletion

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires