> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kinesis Stream Shard Level Metrics

### More Info:

Ensure enhanced Amazon Kinesis stream monitoring for shard-level metrics is enabled in order to increase visibility into your streams performance. Kinesis is a platform for streaming data on Amazon Web Services that provides you with the ability to build and manage your own custom streaming data applications for specialized needs. A Kinesis stream is an ordered sequence of data records collected within a dedicated storage layer. The data records within a Kinesis stream is distributed into unique identified groups called shards.

### Risk Level

Low

### Address

Cost optimization, Operational Maturity

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB, you can follow these steps using the AWS Management Console:

        1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and login using your credentials.

        2. **Navigate to DynamoDB Service**: From the list of AWS services, click on "DynamoDB" to open the DynamoDB dashboard.

        3. **Select the Table**: In the DynamoDB dashboard, select the table for which you want to remediate the misconfiguration related to Kinesis Stream Shard Level Metrics.

        4. **Edit Table Settings**:
           * Click on the "Overview" tab for the selected table.
           * Scroll down to the "Table details" section and click on the "Manage stream" button.

        5. **Update Stream Settings**:
           * In the "Manage stream" dialog box, select the option to enable the stream for the DynamoDB table.
           * Choose the stream view type as "New and old images" or "New images" based on your requirements.
           * Click on the "Create" button to save the changes.

        6. **Verify Configuration**:
           * Once the stream is enabled for the DynamoDB table, verify that the Kinesis Stream Shard Level Metrics are now active and functioning properly.

        By following these steps, you can successfully remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB using AWS CLI, follow these steps:

        1. Open your terminal and configure AWS CLI with the necessary credentials by running the following command:

        ```
        aws configure
        ```

        Enter your AWS Access Key ID, Secret Access Key, default region, and default output format as prompted.

        2. Enable Kinesis Stream Shard Level Metrics for the DynamoDB table using the AWS CLI by running the following command:

        ```
        aws dynamodb update-continuous-backups --table-name YOUR_TABLE_NAME --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true
        ```

        Replace `YOUR_TABLE_NAME` with the name of your DynamoDB table.

        3. Verify that Kinesis Stream Shard Level Metrics have been successfully enabled for the DynamoDB table by running the following command:

        ```
        aws dynamodb describe-continuous-backups --table-name YOUR_TABLE_NAME
        ```

        Replace `YOUR_TABLE_NAME` with the name of your DynamoDB table. Check the output to ensure that `PointInTimeRecoverySpecification` shows `PointInTimeRecoveryEnabled` as `true`.

        By following these steps, you can remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration related to Kinesis Stream Shard Level Metrics for AWS DynamoDB using Python, you can follow these steps:

        1. **Install boto3**: If you haven't already, install the boto3 library in Python. You can do this using pip by running the following command:
           ```
           pip install boto3
           ```

        2. **Update the CloudWatch Metrics Configuration**: Use the following Python script to update the CloudWatch Metrics configuration for the DynamoDB table:

        ```python theme={null}
        import boto3

        def update_dynamodb_cloudwatch_metrics(table_name):
            client = boto3.client('dynamodb')

            response = client.update_continuous_backups(
                TableName=table_name,
                PointInTimeRecoverySpecification={
                    'PointInTimeRecoveryEnabled': True
                }
            )

            print(response)

        # Replace 'your_table_name' with the name of your DynamoDB table
        update_dynamodb_cloudwatch_metrics('your_table_name')
        ```

        3. **Run the Python Script**: Save the above Python script in a file, and run it in your Python environment. This script will enable continuous backups for the specified DynamoDB table, which will ensure that the CloudWatch Metrics for the table are properly configured.

        By following these steps, you can remediate the misconfiguration related to Kinesis Stream Shard Level Metrics for AWS DynamoDB using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_kinesis_stream" "THIS_STREAM" {
          name             = "REPLACE_WITH_STREAM_NAME"
          shard_count      = REPLACE_WITH_DESIRED_SHARD_COUNT

          # Enable all shard-level enhanced monitoring metrics
          shard_level_metrics = ["ALL"]
        }
        ```

        Substitute:

        * `REPLACE_WITH_STREAM_NAME` with your Kinesis stream name.
        * `REPLACE_WITH_DESIRED_SHARD_COUNT` with the intended shard count (integer).

        This matches the CLI action `enable-enhanced-monitoring --shard-level-metrics ALL` and does not force stream replacement; Terraform will update the existing stream in place. Enabling enhanced monitoring will incur additional CloudWatch metrics cost.

        To verify, `terraform plan` should show a single `~ update in-place` on `aws_kinesis_stream.THIS_STREAM` with `shard_level_metrics` changing from `[]` (or a smaller set) to `["ALL"]`.

        Note: DynamoDB is a different AWS service; this specific finding and remediation only apply to `aws_kinesis_stream`, not to DynamoDB tables or streams.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>