Kinesis SSE Not Configured

  • Query id: 7f65be75-90ab-4036-8c2a-410aef7bb650
  • Query name: Kinesis SSE Not Configured
  • Platform: CloudFormation
  • Severity: High
  • Category: Encryption
  • URL: Github

Description

AWS Kinesis Stream should have SSE (Server Side Encryption) defined
Documentation

Code samples

Code samples with security vulnerabilities

Postitive test num. 1 - yaml file
Resources:
  EventStream1:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      StreamEncryption:
            EncryptionType: KMS
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}
  EventStream2:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      StreamEncryption:
            KeyId: !Ref myKey
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}
  EventStream3:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}
Postitive test num. 2 - json file
{
  "Resources": {
    "EventStream1": {
      "Type": "AWS::Kinesis::Stream",
      "Properties": {
        "Name": "EventStream",
        "RetentionPeriodHours": 24,
        "ShardCount": 1,
        "StreamEncryption": {
          "EncryptionType": "KMS"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "${EnvironmentName}-EventStream-${AWS::Region}"
          }
        ]
      }
    },
    "EventStream2": {
      "Type": "AWS::Kinesis::Stream",
      "Properties": {
        "Name": "EventStream",
        "RetentionPeriodHours": 24,
        "ShardCount": 1,
        "StreamEncryption": {
          "KeyId": "myKey"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "${EnvironmentName}-EventStream-${AWS::Region}"
          }
        ]
      }
    },
    "EventStream3": {
      "Type": "AWS::Kinesis::Stream",
      "Properties": {
        "Name": "EventStream",
        "RetentionPeriodHours": 24,
        "ShardCount": 1,
        "Tags": [
          {
            "Key": "Name",
            "Value": "${EnvironmentName}-EventStream-${AWS::Region}"
          }
        ]
      }
    }
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - yaml file
Resources:
  EventStream:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: EventStream
      RetentionPeriodHours: 24
      ShardCount: 1
      StreamEncryption:
            EncryptionType: KMS
            KeyId: !Ref myKey
      Tags:
        - Key: Name
          Value: !Sub ${EnvironmentName}-EventStream-${AWS::Region}
Negative test num. 2 - json file
{
  "Resources": {
    "EventStream": {
      "Type": "AWS::Kinesis::Stream",
      "Properties": {
        "Tags": [
          {
            "Key": "Name",
            "Value": "${EnvironmentName}-EventStream-${AWS::Region}"
          }
        ],
        "Name": "EventStream",
        "RetentionPeriodHours": 24,
        "ShardCount": 1,
        "StreamEncryption": {
          "EncryptionType": "KMS",
          "KeyId": "myKey"
        }
      }
    }
  }
}