You are planning to use AWS Kinesis Data Streams for an application developed for a company.
The company policy mandates that all data stored at rest should be encrypted. How can you accomplish this in the easiest way for Kinesis Data Streams?
Click on the arrows to vote for the correct answer
A. B. C. D.Answer: B.
Options A is incorrect because this would involve too much effort for encrypting and decrypting the streams by using SDK.
Option B is CORRECT because server-side encryption is a feature in Amazon Kinesis Data Streams that automatically encrypts data before it's at rest by using an AWS KMS customer master key (CMK) you specify.
Data is encrypted before it's written to the Kinesis Data Stream storage layer and decrypted after it's retrieved from storage.
As a result, your data is encrypted at rest within the Kinesis Data Streams service.
This allows you to meet strict regulatory requirements and enhance the security of your data.
Options C is incorrect because this would involve too much effort for encrypting and decrypting the streams by using client-side encryption.
Option D is incorrect since this is the same as encrypting the data before it reaches the Kinesis Data Stream which is not required as per the asks.
Reference:
https://docs.aws.amazon.com/streams/latest/dev/what-is-sse.htmlThe easiest way to encrypt data at rest in Kinesis Data Streams is to enable server-side encryption. Therefore, option B is the correct answer.
Server-side encryption for Kinesis Data Streams encrypts data at rest by using AWS KMS-managed keys or customer-managed keys. With server-side encryption, Kinesis Data Streams automatically encrypts incoming data before storing it in the data stream, and decrypts the data before returning it to an authorized consumer. This means that the data is always encrypted when it is at rest in Kinesis Data Streams, and the encryption and decryption processes are completely transparent to the application.
Enabling server-side encryption for Kinesis Data Streams is a simple process that can be done through the AWS Management Console, AWS SDKs, or AWS CLI. When creating a new Kinesis data stream, you can select an encryption option, or you can enable encryption for an existing stream by modifying its settings.
Using the SDK to encrypt the data before being stored at rest, as suggested in option A, is a viable option but requires additional development effort to implement and maintain encryption code.
Client-side encryption, as suggested in option C, requires the data to be encrypted before it is sent to Kinesis Data Streams, and decrypted after being retrieved. This approach adds complexity to the application and may result in higher latency, especially for large amounts of data.
Using the AWS CLI to encrypt data, as suggested in option D, is also a viable option but requires manual intervention every time new data is added to the data stream, which may not be practical for many use cases.
Therefore, enabling server-side encryption is the most straightforward and easiest way to ensure that all data stored at rest in Kinesis Data Streams is encrypted.