01 Run describe-delivery-stream command (OSX/Linux/UNIX) using the name of the Firehose delivery stream that you want to reconfigure as the identifier parameter and custom query filters to return the selected stream configuration metadata, information required later when the delivery stream is reconfigured:
aws firehose describe-delivery-stream
--region us-east-1
--delivery-stream-name cc-main-delivery-stream
02 The command output should return the stream configuration information:
{
"DeliveryStreamDescription": {
"DeliveryStreamType": "DirectPut",
"HasMoreDestinations": false,
"LastUpdateTimestamp": 1633030856.449,
"DeliveryStreamEncryptionConfiguration": {
"KeyARN": "arn:aws:kms:us-east-1:123456789012:key/abcd1234-abcd-1234-abcd-1234abcd1234",
"Status": "ENABLED",
"KeyType": "CUSTOMER_MANAGED_CMK"
},
"VersionId": "9",
"CreateTimestamp": 1632989655.816,
"DeliveryStreamARN": "arn:aws:firehose:us-east-1:123456789012:deliverystream/cc-main-delivery-stream",
"DeliveryStreamStatus": "ACTIVE",
"DeliveryStreamName": "cc-main-delivery-stream",
"Destinations": [
{
"DestinationId": "destinationId-000000000001",
"ExtendedS3DestinationDescription": {
"EncryptionConfiguration": {
"NoEncryptionConfig": "NoEncryption"
},
"DataFormatConversionConfiguration": {
"Enabled": false
},
"RoleARN":
"arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-cc-main-delivery-stream-us-east-1-1632989075086",
"CompressionFormat": "UNCOMPRESSED",
"BufferingHints": {
"IntervalInSeconds": 300,
"SizeInMBs": 5
},
"ErrorOutputPrefix": "",
"Prefix": "",
"S3BackupMode": "Disabled",
"CloudWatchLoggingOptions": {
"Enabled": true,
"LogStreamName": "DestinationDelivery",
"LogGroupName": "/aws/kinesisfirehose/cc-main-delivery-stream"
},
"BucketARN": "arn:aws:s3:::cc-kinesis-s3-bucket",
"ProcessingConfiguration": {
"Enabled": false,
"Processors": []
}
},
"S3DestinationDescription": {
"EncryptionConfiguration": {
"NoEncryptionConfig": "NoEncryption"
},
"RoleARN":
"arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-cc-main-delivery-stream-us-east-1-1632989075086",
"CompressionFormat": "UNCOMPRESSED",
"BufferingHints": {
"IntervalInSeconds": 300,
"SizeInMBs": 5
},
"ErrorOutputPrefix": "",
"Prefix": "",
"CloudWatchLoggingOptions": {
"Enabled": true,
"LogStreamName": "DestinationDelivery",
"LogGroupName": "/aws/kinesisfirehose/cc-main-delivery-stream"
},
"BucketARN": "arn:aws:s3:::cc-kinesis-s3-bucket"
}
}
]
}
}
03 Create the configuration document required for the update-destination command using the information returned at the previous step and save the document to a JSON file named data-destination-config.json. The "AWSKMSKeyARN" attribute value (highlighted) represents the ARN of the KMS key used to encrypt your Firehose delivery stream data records at destination:
{
"RoleARN":
"arn:aws:iam::123456789012:role/service-role/KinesisFirehoseServiceRole-cc-main-delivery-stream-us-east-1-1632989075086",
"BucketARN": "arn:aws:s3:::cc-kinesis-s3-bucket",
"Prefix": "",
"BufferingHints": {
"SizeInMBs": 5,
"IntervalInSeconds": 300
},
"CompressionFormat": "UNCOMPRESSED",
"EncryptionConfiguration": {
"KMSEncryptionConfig": {
"AWSKMSKeyARN": "arn:aws:kms:us-east-1:123456789012:key/abcdabcd-1234-1234-1234-abcdabcdabcd"
}
},
"CloudWatchLoggingOptions": {
"Enabled": true,
"LogGroupName": "/aws/kinesisfirehose/cc-main-delivery-stream",
"LogStreamName": "DestinationDelivery"
},
"ProcessingConfiguration": {
"Enabled": false,
"Processors": []
},
"S3BackupMode": "Disabled"
}
04 Run update-destination command (OSX/Linux/UNIX) using the Firehose delivery stream that you want to reconfigure as the identifier parameter, to update the destination configuration of the selected delivery stream in order to enable encryption of delivery stream data records at destination (the command does not produce an output):
aws firehose update-destination
--region us-east-1
--delivery-stream-name cc-main-delivery-stream
--current-delivery-stream-version-id 3
--destination-id destinationId-000000000001
--extended-s3-destination-update file://data-destination-config.json
05 Repeat steps no. 1 – 4 for each Firehose delivery stream that you want to reconfigure, available in the selected AWS region.
06 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.
Security 