1. Navigate to Kinesis Console:
   • Open the AWS Management Console and navigate to the Kinesis service.
2. Select the Stream:
   • From the list of Streams, select the Stream for which you want to enable encryption.
3. Enable Server-Side Encryption:
   • In the Stream details page, locate the Configuration section for Server-Side Encryption.
   • Under “Server-side encryption”, click “Edit” to change the encryption settings.
   • Enable “Server-side encryption”
4. Choose Encryption Type:
   • Select the option for Kinesis Server-Side Encryption. AWS managed key (aws/kinesis) or Customer managed key (specify your KMS key ARN)
   • You may need to provide additional details such as KMS Key ARN for encryption.
5. Save Changes:
   • After configuring the encryption settings, save the changes by clicking on the ‘Save’ or ‘Update’ button.
6. Verify Encryption Status:
   • Once the changes are saved, verify that the Server-Side Encryption is enabled for the Kinesis Data Stream.

​

1. Check the current encryption status: Run the following AWS CLI command to check the current encryption status of your Kinesis Data Stream:
   aws kinesis describe-stream --stream-name STREAM_NAME
   
   This command will return information about the specified Kinesis Data Stream, including the encryption settings.
2. Enable Server-Side Encryption: If the encryption is not enabled, you can enable Server-Side Encryption for the Kinesis Data Stream using the following AWS CLI command:
    aws kinesis start-stream-encryption \
    --stream-name YOUR_STREAM_NAME \
    --encryption-type KMS \
    --key-id alias/aws/kinesis
   
   Using Customer Managed Key:
   aws kinesis start-stream-encryption \
   --stream-name YOUR_STREAM_NAME \
   --encryption-type KMS \
   --key-id arn:aws:kms:REGION:ACCOUNT-ID:key/KEY-ID
   
   Replace YOUR_STREAM_NAME with the actual name of your Kinesis Data Stream. This command will enable Server-Side Encryption for the specified Kinesis Data Stream.
3. Verify Encryption: After enabling Server-Side Encryption, you can verify the encryption status by running the describe-table command again:
   aws kinesis describe-stream --stream-name STREAM_NAME
   
   Ensure that the SSEDescription section in the output confirms that Server-Side Encryption is enabled for the Kinesis Data Stream.

1. Import the necessary Python libraries:

import boto3

2. Initialize the Kinesis client:

kinesis_client = boto3.client('kinesis')

3. Enable server-side encryption for the Kinesis Data Stream using the start_stream_encryption method:

stream_name = 'YOUR_STREAM_NAME'

response = kinesis_client.start_stream_encryption(
    StreamName=stream_name,
    EncryptionType='KMS',
    KeyId=key_id
)

4. Verify that server-side encryption with KMS is enabled for the Kinesis Data Stream:

response = kinesis_client.describe_stream(StreamName=stream_name)
encryption_type = response['StreamDescription'].get('EncryptionType', 'NONE')
key_id = response['StreamDescription'].get('KeyId', 'N/A')

print(f"Stream: {stream_name}")
print(f"Encryption Type: {encryption_type}")
print(f"Key ID: {key_id}")

5. Run the Python script to apply the changes and verify that server-side encryption with KMS is enabled for the Kinesis Data Stream.

resource "aws_kinesis_stream" "THIS_STREAM" {
  name = "KINESIS_STREAM_NAME" # replace with your stream name

  # other required arguments for your stream here, for example:
  # shard_count = 1
  # or stream_mode_details { stream_mode = "ON_DEMAND" }

  # Enable server-side encryption using the default AWS-managed KMS key for Kinesis
  encryption_type = "KMS"
  kms_key_id      = "alias/aws/kinesis"
}

• KINESIS_STREAM_NAME with the actual Kinesis stream name.
• Add any other arguments your existing aws_kinesis_stream uses so Terraform manages the same stream rather than creating a new one.