feat(kinesisfirehose-alpha): enable server-side encryption for delivery stream by default #31858
Conversation
…ry stream by default
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
This PR may be closed and a warning added instead with |
| @@ -328,17 +331,20 @@ export class DeliveryStream extends DeliveryStreamBase { | |||
| }); | |||
| } | |||
|
|
|||
| const encryption = props.encryption ?? StreamEncryption.awsOwnedKey(); | |||
| const encryptionKey = encryption.encryptionKey ?? (encryption.type === StreamEncryptionType.CUSTOMER_MANAGED ? new kms.Key(this, 'Key') : undefined); | |||
There was a problem hiding this comment.
This encryptionKey feels a bit off to me. Generally if it's a customer managed key, I believe we should allow users to be able to specify a key themselve instead of always creating a key for them.
There was a problem hiding this comment.
For customer managed key, passing in their own key is optional so this only creates a key when customer managed key is set if they didn't pass in their own, otherwise const encryptionKey = encryption.encryptionKey would use the key provided.
| "DeliveryStreamEncryptionConfigurationInput": { | ||
| "KeyType": "AWS_OWNED_CMK" | ||
| }, |
There was a problem hiding this comment.
Didn't we use unencrypted in the integration test file?
There was a problem hiding this comment.
oh wait you're right. that's weird..lemme double check that
|
Closing this PR as we've decided to keep the default value as |
|
Comments on closed issues and PRs are hard for our team to see. |
Reason for this change
SSE on delivery streams were disabled by default (unencrypted) which is against security best practices. This PR changes that default to enable SSE with an AWS_OWNED key.
Description of changes
Changed default value for
encryptionproperty fromStreamEncryption.unencrypted()toStream.awsOwnedKey().Description of how you validated changes
Checklist
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license
BREAKING CHANGE: Changed default value for
encryptionproperty fromStreamEncryption.unencrypted()toStream.awsOwnedKey(). To get the old behaviour, disable SSE by explicitly settingencryption: StreamEncryption.unencrypted()in your stack.