Enabling SSE for Kinesis Firehose


We have Kinesis Firehose as a target for EventBridge (source Direct put) with S3 bucket as the destination. We did not have SSE enabled for Firehose. We would like to enable it. The destination S3 bucket has encryption enabled (Amazon S3-managed keys (SSE-S3)). Do we just need to allow encrypt/decrypt permissions for the CMK in firehose role only? Or will Event Bridge and S3 need encrypt/decrypt permissions for the CMK?

How does encryption work in this scenario?

Any impact to existing objects in S3? If archive is enabled for event bridge, any impact to replay older events?

asked 8 months ago115 views
1 Answer

Firehose SSE / CMK encryption should not affect encryption to S3 SSE. SSE = Server Side Encryption (Not TLS or encryption in transit). Meaning that the records on the Kinesis / Firehose stream are encrypted and it is localized to the service (Firehose and S3).

I have performed the below test in my environment:

Firehose (Not encrypted) to S3 (SSE-S3)

Then enabled SSE or CMK on Firehose. There was no effect and Delivery was successful

answered 8 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions