Amazon Data Firehose controls
These controls are related to Amazon Data Firehose resources.
These controls may not be available in all Amazon Web Services Regions. For more information, see Availability of controls by Region.
[DataFirehose.1] Firehose delivery streams should be encrypted at rest
Related requirements: NIST.800-53.r5 AC-3, NIST.800-53.r5 AU-3, NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-28
Category: Protect > Data Protection > Encryption of data-at-rest
Severity: Medium
Resource type:
AWS::KinesisFirehose::DeliveryStream
Amazon Config rule:
kinesis-firehose-delivery-stream-encrypted
Schedule type: Periodic
Parameters: None
This control checks whether an Amazon Data Firehose delivery stream is encrypted at rest with server-side encryption. This control fails if a Firehose delivery stream isn't encrypted at rest with server-side encryption.
Server-side encryption is a feature in Amazon Data Firehose delivery streams that automatically encrypts data before it's at rest by using a key created in Amazon Key Management Service (Amazon KMS). Data is encrypted before it's written to the Data Firehose stream storage layer, and decrypted after it’s retrieved from storage. This allows you to comply with regulatory requirements and enhance the security of your data.
Remediation
To enable server-side encryption on Firehose delivery streams,, see Data Protection in Amazon Data Firehose in the Amazon Data Firehose Developer Guide.