Kinesis Stream encryption should support the Master Kinesis key
See original GitHub issueThe L1 construct for Kinesis Stream accepts a string KeyId
which can be any of arn, guid, or alias. The L2 construct only supports a keyArn, which hinders the use of Amazon-managed aliases such as alias/aws/kinesis
.
This may be a change to EncryptionKey more than Kinesis, as EncryptionKey may need to understand the special nature of alias/aws
keys, and make changes to such keys a no-op.
Issue Analytics
- State:
- Created 5 years ago
- Reactions:5
- Comments:6 (5 by maintainers)
Top Results From Across the Web
Data Protection in Amazon Kinesis Data Streams
Server-side encryption using AWS Key Management Service (AWS KMS) keys makes it easy for you to meet strict data management requirements by encrypting...
Read more >Kinesis Stream Encrypted With CMK | Trend Micro
Ensure AWS Kinesis streams are encrypted with KMS Customer Master Keys for complete control over data encryption and decryption.
Read more >AWS Kinesis streams are encrypted with customer managed ...
AWS Kinesis streams are encrypted with customer managed CMK ... Use KMS customer-managed keys to protect the Kinesis Streams and metadata. Using KMS...
Read more >What Is Server-Side Encryption for Kinesis Data Streams?
As a result, your data is encrypted at rest within the Kinesis Data Streams service. This allows you to meet strict regulatory requirements...
Read more >Ensure Kinesis Stream is encrypted by KMS using a customer ...
This policy identifies the AWS Kinesis streams which are encrypted with default KMS keys and not with Master Keys managed by Customer. It...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
We haven’t updated the system that encountered this issue to the latest CDK, so it will be some time before I can verify that the use case is covered; that said, the fragment above isn’t large, so perhaps I or someone else can rewrite it in the new syntax and verify the Cfn output.
Now that
Alias
implementsIKey
, and can be used anywhere a KMS key can, is this issue now solved?@lambrospetrou @ccurrie-amzn ?