> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kinesis stream encrypted with cmk remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of a Kinesis Stream encrypted with a Customer Master Key (CMK) for AWS DynamoDB using the AWS Management Console, follow these steps:

        1. **Access the AWS Management Console**: Go to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com).

        2. **Navigate to DynamoDB Service**: Click on the "Services" dropdown menu at the top left corner of the console. Under the "Database" section, click on "DynamoDB" to open the DynamoDB dashboard.

        3. **Select the DynamoDB Table**: In the DynamoDB dashboard, locate and click on the table that you want to remediate the encryption settings for.

        4. **Edit Table Encryption Settings**:
           * Click on the "Overview" tab to view the details of the selected DynamoDB table.
           * In the "Overview" tab, click on the "Manage" button next to the "Encryption" section.

        5. **Update Encryption Settings**:
           * In the "Encryption" settings page, locate the "Encryption Type" section.
           * Click on the "Edit" button to modify the encryption settings for the DynamoDB table.

        6. **Select Encryption Type**:
           * In the "Edit encryption" dialog box, choose the desired encryption type. To remediate the misconfiguration of Kinesis Stream encryption with CMK, select "AWS managed key (AWS KMS)".

        7. **Choose AWS Managed Key (KMS)**:
           * Select the appropriate AWS managed key (KMS) from the dropdown list. Ensure that you choose the key that aligns with your security and compliance requirements.

        8. **Save Changes**:
           * After selecting the AWS managed key (KMS), click on the "Save" button to apply the encryption settings changes to the DynamoDB table.

        9. **Verify Encryption Settings**:
           * Once the changes are saved, verify that the encryption settings have been successfully updated to use the AWS managed key (KMS) instead of the Kinesis Stream encryption.

        By following these steps, you can remediate the misconfiguration of a Kinesis Stream encrypted with a CMK for AWS DynamoDB using the AWS Management Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of a Kinesis Stream encrypted with a Customer Managed Key (CMK) for AWS DynamoDB using AWS CLI, you can follow these steps:

        1. **Identify the DynamoDB Table**: First, identify the DynamoDB table that is using the Kinesis Stream encrypted with CMK.

        2. **Disable Encryption with CMK for Kinesis Stream**: To remediate this misconfiguration, you will need to disable encryption with CMK for the Kinesis Stream associated with the DynamoDB table. You can achieve this by updating the Kinesis Stream settings.

        3. **Update Kinesis Stream Encryption Settings**:

           * Open the AWS CLI and run the following command to update the encryption settings of the Kinesis Stream associated with the DynamoDB table:

             ```bash theme={null}
             aws kinesis update-stream --stream-name YOUR_STREAM_NAME --encryption-type NONE
             ```

             Replace `YOUR_STREAM_NAME` with the actual name of the Kinesis Stream associated with the DynamoDB table.

        4. **Verify Encryption Settings**: Once you have updated the encryption settings for the Kinesis Stream, verify that the encryption type is set to `NONE` to ensure that the Kinesis Stream is no longer encrypted with a CMK.

        5. **Monitor DynamoDB Table**: Monitor the DynamoDB table to ensure that there are no issues or disruptions after making this change.

        By following these steps and updating the encryption settings for the Kinesis Stream associated with the DynamoDB table to use encryption type `NONE`, you can remediate the misconfiguration of a Kinesis Stream encrypted with a CMK for AWS DynamoDB.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of a Kinesis Stream not being encrypted with a Customer Managed Key (CMK) in AWS, we need to create a new Kinesis Stream with encryption enabled using a CMK. Here are the step-by-step instructions on how to remediate this issue for AWS DynamoDB using Python:

        1. **Import the necessary Python libraries:**

        ```python theme={null}
        import boto3
        ```

        2. **Create a new Kinesis Stream with encryption enabled:**

        ```python theme={null}
        def remediate_kinesis_stream_encryption(stream_name, cmk_arn):
            client = boto3.client('kinesis')

            response = client.create_stream(
                StreamName=stream_name,
                ShardCount=1,
                EncryptionType='KMS',
                KmsKeyId=cmk_arn
            )

            print(f"New Kinesis Stream '{stream_name}' created with encryption using CMK '{cmk_arn}'")
        ```

        3. **Replace the `stream_name` and `cmk_arn` variables with your desired values:**

        ```python theme={null}
        stream_name = 'your-kinesis-stream-name'
        cmk_arn = 'your-cmk-arn'
        ```

        4. **Call the `remediate_kinesis_stream_encryption` function with the appropriate parameters:**

        ```python theme={null}
        remediate_kinesis_stream_encryption(stream_name, cmk_arn)
        ```

        5. **Run the Python script to create the new Kinesis Stream with encryption enabled using a CMK:**

        ```python theme={null}
        if __name__ == '__main__':
            remediate_kinesis_stream_encryption(stream_name, cmk_arn)
        ```

        By following these steps and running the Python script, you can remediate the misconfiguration of a Kinesis Stream not being encrypted with a CMK in AWS DynamoDB.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_kms_key" "KINESIS_CMK" {
          description = "CMK for Kinesis stream KINESIS_STREAM_NAME"
          # Optionally set key policy, rotation, etc.
        }

        resource "aws_kinesis_stream" "THIS_STREAM" {
          name             = "KINESIS_STREAM_NAME" # replace with your stream name
          shard_count      = 1                     # set as needed

          encryption_type = "KMS"
          kms_key_id      = aws_kms_key.KINESIS_CMK.arn
        }
        ```

        This config enables server-side encryption on the Kinesis stream using a customer-managed KMS key, matching the CLI `start-stream-encryption` behavior (with `encryption-type KMS` and `key-id` set to the CMK ARN).

        This change should be applied in-place (no forced replacement of the stream); `terraform plan` should show an update to the existing `aws_kinesis_stream` resource adding `encryption_type = "KMS"` and `kms_key_id = <CMK ARN>`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>