> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Firehose Delivery Stream Destination Should Have Encryption ### More Info: Ensure that your Kinesis Firehose delivery stream data records are encrypted at destination (i.e. Amazon S3) in order to meet regulatory requirements and protect your Firehose data at rest. The Firehose data records can be encrypted in the destination bucket using an AWS-managed CMK or a KMS Customer Master Key (CMK). ### Risk Level Medium ### Address Cost optimization, Operational Maturity, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * GDPR * HIPAA * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of Firehose Delivery Stream Destination Encryption for AWS DynamoDB using the AWS console, follow these steps: 1. **Sign in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and sign in to your AWS account. 2. **Navigate to Amazon Kinesis**: In the AWS Management Console, navigate to the Amazon Kinesis service by either searching for it in the search bar or locating it under the "Analytics" section. 3. **Select the Kinesis Data Firehose service**: Click on "Kinesis Data Firehose" from the list of services. 4. **Choose your Delivery Stream**: Select the specific delivery stream that is connected to the DynamoDB table that you want to remediate. 5. **Edit the Delivery Stream**: Click on the "Edit" button to modify the settings of the delivery stream. 6. **Enable Server-Side Encryption**: In the "Destination" section, locate the "Server-Side Encryption" option and enable it. 7. **Select the Encryption Type**: Choose the appropriate encryption type for your DynamoDB data. You can select either "AWS KMS master key" or "Amazon S3 master key" based on your security requirements. 8. **Configure Encryption Settings**: Follow the on-screen instructions to configure the encryption settings, such as selecting the KMS key or S3 key to use for encryption. 9. **Save Changes**: Once you have configured the encryption settings, click on the "Save" button to apply the changes to the delivery stream. 10. **Verify Encryption Configuration**: After saving the changes, verify that the server-side encryption is enabled for the delivery stream by checking the settings. By following these steps, you can remediate the misconfiguration of Firehose Delivery Stream Destination Encryption for AWS DynamoDB using the AWS console. # To remediate the misconfiguration of Firehose Delivery Stream Destination Encryption for AWS DynamoDB using AWS CLI, follow these steps: 1. Open your terminal or command prompt. 2. Use the following AWS CLI command to update the Firehose Delivery Stream with the correct encryption settings: ```bash theme={null} aws firehose update-destination --delivery-stream-name YOUR_DELIVERY_STREAM_NAME --current-delivery-stream-version-id YOUR_DELIVERY_STREAM_VERSION_ID --destination-id YOUR_DESTINATION_ID --extended-s3-destination-update '{ "EncryptionConfiguration": { "NoEncryptionConfig": {} } }' ``` Replace the placeholders with the actual values: * `YOUR_DELIVERY_STREAM_NAME`: The name of your Firehose Delivery Stream. * `YOUR_DELIVERY_STREAM_VERSION_ID`: The version ID of your Firehose Delivery Stream. * `YOUR_DESTINATION_ID`: The ID of the destination you want to update. 3. After running the command, the Firehose Delivery Stream Destination Encryption for AWS DynamoDB should be successfully updated to use no encryption. By following these steps, you should be able to remediate the misconfiguration of Firehose Delivery Stream Destination Encryption for AWS DynamoDB using AWS CLI. To remediate the misconfiguration of Firehose Delivery Stream Destination Encryption for AWS DynamoDB using Python, you can follow these steps: 1. Install the AWS SDK for Python (Boto3) if you haven't already. You can install it using pip: ``` pip install boto3 ``` 2. Use the following Python script to update the Firehose Delivery Stream Destination Encryption for AWS DynamoDB: ```python theme={null} import boto3 def remediate_firehose_encryption(): # Initialize the DynamoDB client firehose_client = boto3.client('firehose') # Specify the Firehose Delivery Stream name delivery_stream_name = 'YOUR_DELIVERY_STREAM_NAME' # Specify the KMS key ARN for encryption kms_key_arn = 'YOUR_KMS_KEY_ARN' # Update the Delivery Stream with the specified KMS key for encryption response = firehose_client.update_destination( DeliveryStreamName=delivery_stream_name, CurrentDeliveryStreamVersionId='1', DestinationId='destinationId', ExtendedS3DestinationUpdate={ 'EncryptionConfiguration': { 'KMSEncryptionConfig': { 'AWSKMSKeyARN': kms_key_arn } } } ) print('Firehose Delivery Stream Destination Encryption has been successfully updated.') if __name__ == '__main__': remediate_firehose_encryption() ``` 3. Replace `'YOUR_DELIVERY_STREAM_NAME'` with the name of your Firehose Delivery Stream and `'YOUR_KMS_KEY_ARN'` with the ARN of the KMS key you want to use for encryption. 4. Run the Python script to update the Firehose Delivery Stream Destination Encryption for AWS DynamoDB. By following these steps, you can successfully remediate the misconfiguration of Firehose Delivery Stream Destination Encryption for AWS DynamoDB using Python. ```hcl theme={null} resource "aws_kinesis_firehose_delivery_stream" "FIREHOSE_STREAM" { name = "FIREHOSE_STREAM_NAME" # replace with your Firehose stream name destination = "extended_s3" # or "s3" / "redshift" as applicable extended_s3_configuration { role_arn = "FIREHOSE_ROLE_ARN" # replace with the IAM role ARN Firehose uses bucket_arn = "S3_BUCKET_ARN" # replace with the destination S3 bucket ARN encryption_configuration { kms_encryption_config { awskms_key_arn = "KMS_KEY_ARN" # replace with your KMS key ARN or arn:aws:kms:REGION:ACCOUNT_ID:alias/aws/s3 } } } # For a plain S3 destination, use s3_configuration {} with the same encryption_configuration block. # For a Redshift destination, add redshift_configuration { ... s3_configuration { ... encryption_configuration { ... } } } } ``` This remediation is applied on the Firehose delivery stream’s S3 (or extended S3 / Redshift staging S3) destination; DynamoDB is not a valid Firehose destination and cannot be used to implement this particular encryption-at-destination control. This change is an in‑place update for an existing `aws_kinesis_firehose_delivery_stream` and should not force resource replacement. After you add the `encryption_configuration` block, `terraform plan` should show an in‑place `~ update` to the delivery stream, adding `encryption_configuration.kms_encryption_config.awskms_key_arn` under the relevant `*_configuration` block. ### Additional Reading: * [https://docs.aws.amazon.com/firehose/latest/dev/encryption.html](https://docs.aws.amazon.com/firehose/latest/dev/encryption.html)