Ravi Sir's Cards › AWS
Secure the stream
This revision card explains Secure the stream. It starts from the need that open producers or plaintext data invite abuse and leaks. It describes encrypt with KMS; IAM on PutRecords/GetRecords; VPC interface endpoints when required. The how-to section notes producers get put on one stream ARN; consumers get get/list; enable CloudWatch metrics. An example on the card is compromised laptop without the producer role cannot PutRecords to prod stream.
Read card text
What this card says
Why do we need it?
Open producers or plaintext data invite abuse and leaks.
What is it?
Encrypt with KMS; IAM on PutRecords/GetRecords; VPC interface endpoints when required.
KMS
How to do it
Producers get put on one stream ARN; consumers get get/list; enable CloudWatch metrics.
Example
Compromised laptop without the producer role cannot PutRecords to prod stream.