Kinesis Firehose delivery stream should have CloudWatch error logging enabled

What it checks

Kinesis Firehose delivery stream should have CloudWatch error logging enabled

Where it applies

Terraform: aws_kinesis_firehose_delivery_stream

CloudFormation: AWS::KinesisFirehose::DeliveryStream

How to fix it

1. Verify and enable CloudWatch error logging on the active destination's existing configuration: Terraform cloudwatch_logging_options or CloudFormation CloudWatchLoggingOptions. Configure the log group, log stream, retention and delivery-role permissions. Backup S3 logging is independent and does not replace active-destination logging. Continue monitoring automatic CloudWatch metrics and destination-specific alarms.

Frameworks

• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules