Question

A data engineering team runs a pipeline that streams financial transaction records from an on-premises system into an Amazon Kinesis Data Stream, then delivers them to Amazon S3 via Amazon Data Firehose. Compliance requires that the data be encrypted both in transit and at rest throughout the pipeline, and that all encryption keys be centrally managed and auditable. Which combination of measures satisfies these requirements with the least custom code?

Accepted Answer

Use HTTPS/TLS endpoints for all API calls, enable server-side encryption on the Kinesis Data Stream with an AWS KMS customer managed key, and configure Firehose to encrypt the S3 destination with a KMS customer managed key.

Answer

Encrypt records in the on-premises application using a custom AES routine before sending them, and store the encryption key in the application's config file so no AWS KMS integration is needed.

Answer

Rely on the default S3 SSE-S3 encryption for data at rest and disable TLS on the Kinesis endpoints to reduce latency, since VPC traffic is already isolated.

Answer

Enable server-side encryption only on the final S3 bucket with an AWS managed key, and allow Kinesis and Firehose to transmit data unencrypted because the pipeline stays within AWS.