Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Kinesis Stream encryption should support the Master Kinesis key

See original GitHub issue

The L1 construct for Kinesis Stream accepts a string KeyId which can be any of arn, guid, or alias. The L2 construct only supports a keyArn, which hinders the use of Amazon-managed aliases such as alias/aws/kinesis.

This may be a change to EncryptionKey more than Kinesis, as EncryptionKey may need to understand the special nature of alias/aws keys, and make changes to such keys a no-op.

Issue Analytics

State:
Created 5 years ago
Reactions:5
Comments:6 (5 by maintainers)

Top GitHub Comments

1reaction

ccurrie-amzncommented, Sep 26, 2019

We haven’t updated the system that encountered this issue to the latest CDK, so it will be some time before I can verify that the use case is covered; that said, the fragment above isn’t large, so perhaps I or someone else can rewrite it in the new syntax and verify the Cfn output.

0reactions

skinny85commented, Sep 26, 2019

Now that Alias implements IKey, and can be used anywhere a KMS key can, is this issue now solved?

@lambrospetrou @ccurrie-amzn ?

Top Results From Across the Web

Data Protection in Amazon Kinesis Data Streams

Server-side encryption using AWS Key Management Service (AWS KMS) keys makes it easy for you to meet strict data management requirements by encrypting...

Kinesis Stream Encrypted With CMK | Trend Micro

Ensure AWS Kinesis streams are encrypted with KMS Customer Master Keys for complete control over data encryption and decryption.

AWS Kinesis streams are encrypted with customer managed ...

AWS Kinesis streams are encrypted with customer managed CMK ... Use KMS customer-managed keys to protect the Kinesis Streams and metadata. Using KMS...

What Is Server-Side Encryption for Kinesis Data Streams?

As a result, your data is encrypted at rest within the Kinesis Data Streams service. This allows you to meet strict regulatory requirements...

Ensure Kinesis Stream is encrypted by KMS using a customer ...

This policy identifies the AWS Kinesis streams which are encrypted with default KMS keys and not with Master Keys managed by Customer. It...