Does Kinesis encrypt its data at rest?

Question

Are Kinesis messages encrypted when they are stored on AWS?

What mechanism is used to persistently store the messages?

Answer 1

Are Kinesis messages encrypted when they are stored on AWS?

Encryption mechanisms of a created Amazon Kinesis stream application follows the same principles as for any other application you create on AWS. So here are the questions you need to ask yourself:

1. Do you control the encryption method and the entire KMI?

In this case, you are responsible for the encrryption/decryption process as well as the management, and use of keys of which AWS has no access.

2. Do you control the encryption method and provide the KMI management layer while AWS provides you the KMI storage component?

In this case, your cryptographic keys are stored in the AWS environment but are not ccessible to AWS' employees. You will need to use AWS CloudHSM.

3. Do you decide to let AWS controls the encryption method and the entire KMI?

In this scenario, AWS manages everything automatically on your behalf: meaning that yes, Kinesis messages are encrypted when stored on AWS.

Practical solution for you:

To avoid troubles, you may use the third option: let AWS do it on your behalf. This corresponds to the third listed case above. For this purpose, the simplest and easiest way for you is to use Amazon Kinesis Firehose which can batch, compress, and encrypt the data before loading it, minimizing the amount of storage used at the destination and increasing security.

What mechanism is used to persistently store the messages?

The data retention period is configurable in hourly increments from 24 (the default retention period) to 168 hours (7 days), and requestable via the Streams Limits form (Amazon Kinesis Streams Limits). Nevertheless, you can persist data to Amazon S3 from Amazon Kinesis Streams using AWS Lambda and Amazon Kinesis Firehose. You can find here a step by step practical example: Persist Streaming Data to Amazon S3 using Amazon Kinesis Firehose and AWS Lambda