Ensure KMS customer managed keys are used for encryption in AWS Kinesis Streams

Using customer managed keys will give administrators control over how data is encrypted to better meet compliance regulations, as well as allow for a more specific key rotation period. Using system-generated keys can sometimes lead to expired or exposed keys remaining in use, leading to insecure data. It is often recommended to use a customer managed key when the service is available.

In AWS Console -

1. Sign in to the AWS Console and open the Kinesis Data Streams Console.
2. Choose the Kinesis stream you wish to edit.
3. Select Details.
4. Under Server-side encryption, select Edit.
5. Set the KMS key configuration as needed and set as Enabled.
6. Select Save.

In Terraform -

1. In the aws_kinesis_stream resource, set the kms_key_id to the appropriate value.

References:
https://docs.aws.amazon.com/streams/latest/dev/what-is-sse.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream#kms_key_id