Kinesis Firehose delivery stream should have server-side encryption enabled

What it checks

Kinesis Firehose delivery stream: optional delivery-stream server-side encryption is not enabled.

Where it applies

Terraform: aws_kinesis_firehose_delivery_stream

CloudFormation: AWS::KinesisFirehose::DeliveryStream

How to fix it

1. Enable server_side_encryption on the delivery stream (AWS-owned key, or a CMK via key_type = CUSTOMER_MANAGED_CMK). Kinesis/MSK source-fed streams cannot configure this Firehose-layer setting; verify upstream encryption independently instead.

Frameworks

• AWS FSBP DataFirehose.1
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules