Kinesis SSE not configured

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: cloudformation-aws-kinesis-sse-not-configured

Provider: AWS

Platform: CloudFormation

Severity: High

Category: Encryption

Learn More

Description

Kinesis streams must have server-side encryption enabled to protect data at rest and reduce the risk of sensitive records being exposed through compromised storage, snapshots, or insider access. In AWS CloudFormation, AWS::Kinesis::Stream resources must include the Properties.StreamEncryption object with EncryptionType and KeyId defined. Resources missing StreamEncryption or with StreamEncryption.EncryptionType or StreamEncryption.KeyId undefined will be flagged as insecure.

Secure CloudFormation example:

MyKinesisStream:
  Type: AWS::Kinesis::Stream
  Properties:
    Name: my-stream
    ShardCount: 1
    StreamEncryption:
      EncryptionType: KMS
      KeyId: arn:aws:kms:us-east-1:123456789012:key/abcd1234-ef56-7890-ab12-3456cdef7890

Compliant Code Examples

Resources:
  EventStream:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      StreamEncryption:
            EncryptionType: KMS
            KeyId: !Ref myKey
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}

Non-Compliant Code Examples

Resources:
  EventStream1:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      StreamEncryption:
            EncryptionType: KMS
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}
  EventStream2:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      StreamEncryption:
            KeyId: !Ref myKey
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}
  EventStream3:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}