Firehose Delivery Stream Destination Encryption

Sign in to the AWS Management Console.

Navigate to Amazon Kinesis console at https://console.aws.amazon.com/kinesis/.

In the navigation panel, under Amazon Kinesis, choose Delivery streams.

Click on the name (link) of the Firehose delivery stream that you want to examine.

Select the Configuration tab to access the stream configuration details.

In the Destination settings section, under Compression and encryption, check the Encryption for data records attribute value. If the Encryption for data records attribute value is set to Disabled, the data records delivered by the selected Firehose delivery stream are not encrypted at destination.

Repeat steps no. 4 - 6 for each Firehose delivery stream available within the current AWS region.

Change the AWS cloud region from the navigation bar to repeat the Audit process for other regions.

Run list-delivery-streams command (OSX/Linux/UNIX) to describe the name of each Kinesis Data Firehose delivery stream available in the selected AWS region:

aws firehose list-delivery-streams
  --region us-east-1
  --query 'DeliveryStreamNames'

The command output should return the requested delivery stream name(s):

[
    "cc-main-delivery-stream",
    "cc-iot-project-delivery-stream"
]

Run describe-delivery-stream command (OSX/Linux/UNIX) using the Firehose delivery stream that you want to examine as the identifier parameter and custom query filters to describe the encryption configuration used for data records at destination (i.e. Amazon S3) by the selected delivery stream:

aws firehose describe-delivery-stream
  --region us-east-1
  --delivery-stream-name cc-main-delivery-stream
  --query 'DeliveryStreamDescription.Destinations[*].ExtendedS3DestinationDescription.EncryptionConfiguration'

The command output should return the requested configuration information:

[
  {
    "NoEncryptionConfig": "NoEncryption"
  }
]

If the describe-delivery-stream command output returns "NoEncryption" for the encryption configuration, as shown in the example above, the data records delivered by the selected Firehose delivery stream are not encrypted at destination.

Repeat steps no. 3 and 4 for each Firehose delivery stream available in the selected AWS region.

Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Sign in to the AWS Management Console.

Navigate to Amazon Kinesis console at https://console.aws.amazon.com/kinesis/.

In the navigation panel, under Amazon Kinesis, choose Delivery streams.

Click on the name of the Firehose delivery stream that you want to reconfigure.

Select the Configuration tab to access the stream configuration details.

In the Destination settings section, choose Edit, and perform the following operations:

1. Choose Buffer hints, compression and encryption.
2. Select Enabled under Encryption for data records to enable encryption for Firehose delivery stream data records at destination (i.e. Amazon S3).
3. For Encryption type, choose whether to use the default master key (i.e. aws/s3 managed key) or a KMS Customer Master Key (CMK) that you create. If you want to use a Customer Master Key (CMK), choose Browse under Customer managed CMK in KMS, and select the appropriate Amazon KMS Customer Master Key (CMK).
4. Choose Save changes to apply the changes. If successful, the Amazon Kinesis console should display the following confirmation message: "Successfully updated delivery stream <stream-name>".

Repeat steps no. 4 - 6 for each Firehose delivery stream that you want to reconfigure, available within the current AWS region.

Change the AWS cloud region from the navigation bar and repeat the Remediation process for other regions.

Run describe-delivery-stream command (OSX/Linux/UNIX) using the name of the Firehose delivery stream that you want to reconfigure as the identifier parameter and custom query filters to return the selected stream configuration metadata, information required later when the delivery stream is reconfigured:

aws firehose describe-delivery-stream
	--region us-east-1
	--delivery-stream-name cc-main-delivery-stream

The command output should return the stream configuration information:

{
  "DeliveryStreamDescription": {
    "DeliveryStreamType": "DirectPut",
    "HasMoreDestinations": false,
    "LastUpdateTimestamp": 1633030856.449,
    "DeliveryStreamEncryptionConfiguration": {
      "KeyARN": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234",
      "Status": "ENABLED",
      "KeyType": "CUSTOMER_MANAGED_CMK"
    },
    "VersionId": "9",
    "CreateTimestamp": 1632989655.816,
    "DeliveryStreamARN": "arn:aws:firehose:us-east-1:123456789012:deliverystream/cc-main-delivery-stream",
    "DeliveryStreamStatus": "ACTIVE",
    "DeliveryStreamName": "cc-main-delivery-stream",
    "Destinations": [
      {
        "DestinationId": "destinationId-000000000001",
        "ExtendedS3DestinationDescription": {
          "EncryptionConfiguration": {
            "NoEncryptionConfig": "NoEncryption"
          },
          "DataFormatConversionConfiguration": {
            "Enabled": false
          },
          "RoleARN":
          "arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-cc-main-delivery-stream-us-east-1-1632989075086",
          "CompressionFormat": "UNCOMPRESSED",
          "BufferingHints": {
            "IntervalInSeconds": 300,
            "SizeInMBs": 5
          },
          "ErrorOutputPrefix": "",
          "Prefix": "",
          "S3BackupMode": "Disabled",
          "CloudWatchLoggingOptions": {
            "Enabled": true,
            "LogStreamName": "DestinationDelivery",
            "LogGroupName": "/aws/kinesisfirehose/cc-main-delivery-stream"
          },
          "BucketARN": "arn:aws:s3:::cc-kinesis-s3-bucket",
          "ProcessingConfiguration": {
            "Enabled": false,
            "Processors": []
          }
        },
        "S3DestinationDescription": {
          "EncryptionConfiguration": {
            "NoEncryptionConfig": "NoEncryption"
          },
          "RoleARN":
          "arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-cc-main-delivery-stream-us-east-1-1632989075086",
          "CompressionFormat": "UNCOMPRESSED",
          "BufferingHints": {
            "IntervalInSeconds": 300,
            "SizeInMBs": 5
          },
          "ErrorOutputPrefix": "",
          "Prefix": "",
          "CloudWatchLoggingOptions": {
            "Enabled": true,
            "LogStreamName": "DestinationDelivery",
            "LogGroupName": "/aws/kinesisfirehose/cc-main-delivery-stream"
          },
          "BucketARN": "arn:aws:s3:::cc-kinesis-s3-bucket"
        }
      }
    ]
  }
}

Create the configuration document required for the update-destination command using the information returned at the previous step and save the document to a JSON file named data-destination-config.json. The "AWSKMSKeyARN" attribute value (highlighted) represents the ARN of the KMS key used to encrypt your Firehose delivery stream data records at destination:

{
  "RoleARN":
  "arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-cc-main-delivery-stream-us-east-1-1632989075086",
  "BucketARN": "arn:aws:s3:::cc-kinesis-s3-bucket",
  "Prefix": "",
  "BufferingHints": {
    "SizeInMBs": 5,
    "IntervalInSeconds": 300
  },
  "CompressionFormat": "UNCOMPRESSED",
  "EncryptionConfiguration": {
    "KMSEncryptionConfig": {
      "AWSKMSKeyARN": "arn:aws:kms:us-east-1:123456789012:key/abcdabcd-1234-1234-1234-abcdabcdabcd"
    }
  },
  "CloudWatchLoggingOptions": {
    "Enabled": true,
    "LogGroupName": "/aws/kinesisfirehose/cc-main-delivery-stream",
    "LogStreamName": "DestinationDelivery"
  },
  "ProcessingConfiguration": {
    "Enabled": false,
    "Processors": []
  },
  "S3BackupMode": "Disabled"
}

Run update-destination command (OSX/Linux/UNIX) using the Firehose delivery stream that you want to reconfigure as the identifier parameter, to update the destination configuration of the selected delivery stream in order to enable encryption of delivery stream data records at destination (the command does not produce an output):

aws firehose update-destination
  --region us-east-1
  --delivery-stream-name cc-main-delivery-stream
  --current-delivery-stream-version-id 3
  --destination-id destinationId-000000000001
  --extended-s3-destination-update file://data-destination-config.json

Repeat steps no. 1 – 4 for each Firehose delivery stream that you want to reconfigure, available in the selected AWS region.

Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.