Ensure that customer managed keys are used in AWS Kinesis Firehose Delivery Stream

AWS Kinesis Server without customer managed keys will leave the data in plain state. customer managed keys will encrypted the data and will be refreshed after every 365 days.

In Terraform -

1. In the aws_kinesis_firehose_delivery_stream resource, set the server_side_encryption.enabled field to true.
2. If using a customer-managed key, set the key_type as CUSTOMER_MANAGED_CMK and the key_arn to the appropriate value.

References:
https://docs.aws.amazon.com/firehose/latest/dev/encryption.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream#server_side_encryption