1. Access the AWS Management Console: Go to the AWS Management Console at https://console.aws.amazon.com.
2. Navigate to DynamoDB Service: Click on the “Services” dropdown menu at the top left corner of the console. Under the “Database” section, click on “DynamoDB” to open the DynamoDB dashboard.
3. Select the DynamoDB Table: In the DynamoDB dashboard, locate and click on the table that you want to remediate the encryption settings for.
4. Edit Table Encryption Settings:
   • Click on the “Overview” tab to view the details of the selected DynamoDB table.
   • In the “Overview” tab, click on the “Manage” button next to the “Encryption” section.
5. Update Encryption Settings:
   • In the “Encryption” settings page, locate the “Encryption Type” section.
   • Click on the “Edit” button to modify the encryption settings for the DynamoDB table.
6. Select Encryption Type:
   • In the “Edit encryption” dialog box, choose the desired encryption type. To remediate the misconfiguration of Kinesis Stream encryption with CMK, select “AWS managed key (AWS KMS)”.
7. Choose AWS Managed Key (KMS):
   • Select the appropriate AWS managed key (KMS) from the dropdown list. Ensure that you choose the key that aligns with your security and compliance requirements.
8. Save Changes:
   • After selecting the AWS managed key (KMS), click on the “Save” button to apply the encryption settings changes to the DynamoDB table.
9. Verify Encryption Settings:
   • Once the changes are saved, verify that the encryption settings have been successfully updated to use the AWS managed key (KMS) instead of the Kinesis Stream encryption.

​

1. Identify the DynamoDB Table: First, identify the DynamoDB table that is using the Kinesis Stream encrypted with CMK.
2. Disable Encryption with CMK for Kinesis Stream: To remediate this misconfiguration, you will need to disable encryption with CMK for the Kinesis Stream associated with the DynamoDB table. You can achieve this by updating the Kinesis Stream settings.
3. Update Kinesis Stream Encryption Settings:
   • Open the AWS CLI and run the following command to update the encryption settings of the Kinesis Stream associated with the DynamoDB table:
     aws kinesis update-stream --stream-name YOUR_STREAM_NAME --encryption-type NONE
     
     Replace YOUR_STREAM_NAME with the actual name of the Kinesis Stream associated with the DynamoDB table.
4. Verify Encryption Settings: Once you have updated the encryption settings for the Kinesis Stream, verify that the encryption type is set to NONE to ensure that the Kinesis Stream is no longer encrypted with a CMK.
5. Monitor DynamoDB Table: Monitor the DynamoDB table to ensure that there are no issues or disruptions after making this change.

1. Import the necessary Python libraries:

import boto3

2. Create a new Kinesis Stream with encryption enabled:

def remediate_kinesis_stream_encryption(stream_name, cmk_arn):
    client = boto3.client('kinesis')

    response = client.create_stream(
        StreamName=stream_name,
        ShardCount=1,
        EncryptionType='KMS',
        KmsKeyId=cmk_arn
    )

    print(f"New Kinesis Stream '{stream_name}' created with encryption using CMK '{cmk_arn}'")

3. Replace the stream_name and cmk_arn variables with your desired values:

stream_name = 'your-kinesis-stream-name'
cmk_arn = 'your-cmk-arn'

4. Call the remediate_kinesis_stream_encryption function with the appropriate parameters:

remediate_kinesis_stream_encryption(stream_name, cmk_arn)

5. Run the Python script to create the new Kinesis Stream with encryption enabled using a CMK:

if __name__ == '__main__':
    remediate_kinesis_stream_encryption(stream_name, cmk_arn)