Understanding encryption in KDF
KDF supports both encryption in transit and encryption at rest. KDF has a REST
API that supports secure HTTP (that is, HTTPS). For encryption at rest, the method employed depends on the data ingestion mechanism. As explained in the Understanding KDF delivery streams section, there are two ways to ingest data into KDF: Direct PUT
and a KDS stream as a source. In addition, KDF has integrations with a number of other AWS services, such as Amazon CloudWatch Logs, Amazon CloudWatch Events, AWS Internet of Things (IoT), or Amazon Simple Notification Service (SNS), which allows those services to send data to KDF.
For Direct PUT
using either PutRecord
or PutRecordBatch
APIs and for other AWS services sending data to KDF, you can enable encryption at rest (or server-side encryption) using an AWS Key Management Service (KMS) customer master key (CMK). The CMK can be either an AWS-owned CMK or a customer-managed CMK. AWS-owned CMKs are not in your account....