Kinesis.1: Kinesis streams should be encrypted at rest

Written and reviewed by Emnode · Last reviewed 27 May 2026

What does AWS Security Hub Kinesis.1 check?

Kinesis.1 fails when a data stream does not have server-side encryption enabled. The control reads the stream's encryption type; a stream not encrypted with a KMS key reports FAILED.

Why does Kinesis.1 matter?

A Kinesis stream often carries clickstream, transaction, or event data that lands in plaintext on AWS-managed storage for the length of its retention window. Server-side encryption protects that data at rest with a KMS key and is a baseline data-protection expectation. Enabling it removes a quiet gap that an auditor or a storage-level exposure would otherwise find.

How do I fix Kinesis.1?

Find unencrypted streams across the region by checking each stream's encryption type.
Call start-stream-encryption with a chosen KMS key, AWS-managed or customer-managed.
Confirm encryption is active, remembering it applies only to records written from now on.
Default new streams to server-side encryption in your provisioning.

Remediation script · bash

# 1. Bulk-enable free SSE-SQS on every unencrypted queue in the region.
for q in $(aws sqs list-queues --query 'QueueUrls[]' --output text); do
  state=$(aws sqs get-queue-attributes --queue-url $q \
    --attribute-names KmsMasterKeyId SqsManagedSseEnabled --query 'Attributes' --output text)
  [ -z "$state" ] && aws sqs set-queue-attributes --queue-url $q \
    --attributes '{"SqsManagedSseEnabled":"true"}' && echo "encrypted $q"
done

# 2. High-throughput stream: SSE-KMS with a 5-minute data-key reuse window to keep KMS cost flat.
aws kinesis start-stream-encryption --stream-name payment-events \
  --encryption-type KMS \
  --key-id arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

# 3. Find unencrypted recovery points (Backup.1 reads IsEncrypted per recovery point, not per vault).
aws backup list-recovery-points-by-backup-vault --backup-vault-name prod-backups \
  --query 'RecoveryPoints[?IsEncrypted==`false`].[RecoveryPointArn,ResourceType]' --output table

# 4. Confirm an at-rest Config rule is evaluating so regressions are caught automatically.
aws configservice describe-compliance-by-config-rule --config-rule-names sqs-queue-encrypted \
  --query 'ComplianceByConfigRules[].Compliance.ComplianceType'

Full walkthrough (console steps, edge cases and verification) in the lesson Encrypt other services at rest (queues, streams, logs, ML).

Is Kinesis.1 a false positive?

Encryption is not retroactive: records already in the retention window stay plaintext until they age out, so a 7-day stream is not fully encrypted at rest until a week after you enable it.

Full lesson Encrypt other services at rest (queues, streams, logs, ML) Step-by-step remediation with CLI, code and persona-specific context.

AWS documentation for Kinesis controls ↗ Check your own account for Kinesis.1 →

Part of the learning path Encrypt everything

Kinesis.3 Kinesis streams should have adequate retention