Kinesis should use in-transit encryption

Severity	Exploitability	Providers	Categories
HIGH	LOW	AWS	DATA, NETWORK, PERMISSION

Description

Amazon Kinesis Data Streams is a serverless streaming data service that makes it easy to capture, process, and store data streams at any scale.

Server-side encryption using AWS KMS ensures that the data is protected when it is moving from one location to another. You must create a User-Generated KMS Master key and specify it manually for a secure access control management.

Impact

Potential data exposure	Visible in logs	User interaction required	Privileges required
True	False	False	True

Not encrypting data in-transit could lead to data leak in case of an attack.

Remediation guidelines

Enable server-side encryption for a new or already-existing Kinesis stream through the AWS Management Console. Make sure to unselect the (default) aws/kinesis KMS master key and generate your own. In your configuration file, you must set the encryption_type variable to "KMS" and put you personal key in kms_key_id.