More Info:
Ensure enhanced Amazon Kinesis stream monitoring for shard-level metrics is enabled in order to increase visibility into your streams performance. Kinesis is a platform for streaming data on Amazon Web Services that provides you with the ability to build and manage your own custom streaming data applications for specialized needs. A Kinesis stream is an ordered sequence of data records collected within a dedicated storage layer. The data records within a Kinesis stream is distributed into unique identified groups called shards.Risk Level
LowAddress
Cost optimization, Operational MaturityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- Cloudanix Best Practice
- DPDPA
- Digital Operational Resilience Act (EU)
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB, you can follow these steps using the AWS Management Console:
- Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login using your credentials.
- Navigate to DynamoDB Service: From the list of AWS services, click on “DynamoDB” to open the DynamoDB dashboard.
- Select the Table: In the DynamoDB dashboard, select the table for which you want to remediate the misconfiguration related to Kinesis Stream Shard Level Metrics.
-
Edit Table Settings:
- Click on the “Overview” tab for the selected table.
- Scroll down to the “Table details” section and click on the “Manage stream” button.
-
Update Stream Settings:
- In the “Manage stream” dialog box, select the option to enable the stream for the DynamoDB table.
- Choose the stream view type as “New and old images” or “New images” based on your requirements.
- Click on the “Create” button to save the changes.
-
Verify Configuration:
- Once the stream is enabled for the DynamoDB table, verify that the Kinesis Stream Shard Level Metrics are now active and functioning properly.
Using CLI
Using CLI
To remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB using AWS CLI, follow these steps:Enter your AWS Access Key ID, Secret Access Key, default region, and default output format as prompted.Replace Replace
- Open your terminal and configure AWS CLI with the necessary credentials by running the following command:
- Enable Kinesis Stream Shard Level Metrics for the DynamoDB table using the AWS CLI by running the following command:
YOUR_TABLE_NAME with the name of your DynamoDB table.- Verify that Kinesis Stream Shard Level Metrics have been successfully enabled for the DynamoDB table by running the following command:
YOUR_TABLE_NAME with the name of your DynamoDB table. Check the output to ensure that PointInTimeRecoverySpecification shows PointInTimeRecoveryEnabled as true.By following these steps, you can remediate the misconfiguration related to Kinesis Stream Shard Level Metrics in AWS DynamoDB using AWS CLI.Using Python
Using Python
To remediate the misconfiguration related to Kinesis Stream Shard Level Metrics for AWS DynamoDB using Python, you can follow these steps:
-
Install boto3: If you haven’t already, install the boto3 library in Python. You can do this using pip by running the following command:
- Update the CloudWatch Metrics Configuration: Use the following Python script to update the CloudWatch Metrics configuration for the DynamoDB table:
- Run the Python Script: Save the above Python script in a file, and run it in your Python environment. This script will enable continuous backups for the specified DynamoDB table, which will ensure that the CloudWatch Metrics for the table are properly configured.
Using Terraform
Using Terraform
REPLACE_WITH_STREAM_NAMEwith your Kinesis stream name.REPLACE_WITH_DESIRED_SHARD_COUNTwith the intended shard count (integer).
enable-enhanced-monitoring --shard-level-metrics ALL and does not force stream replacement; Terraform will update the existing stream in place. Enabling enhanced monitoring will incur additional CloudWatch metrics cost.To verify, terraform plan should show a single ~ update in-place on aws_kinesis_stream.THIS_STREAM with shard_level_metrics changing from [] (or a smaller set) to ["ALL"].Note: DynamoDB is a different AWS service; this specific finding and remediation only apply to aws_kinesis_stream, not to DynamoDB tables or streams.
