A company is planning on making use of Kinesis streams for analysing user trend data for their ecommerce application. The IT Security department has a requirement all data needs to be encrypted at rest. At the same time, the company does not want to manage the internal cryptography or the keys which is required for encryption of data. Which of the following would be the ideal implementation step for such a sort of requirement?

Answer options:

A.Use IAM policies for the encryption of data
B.Enable server-side encryption for Kinesis streams
C.Encrypt the data before sending it to Kinesis streams
D.Use a CloudHSM service for managing the encryption

Answer – B
The AWS Documentation mentions the following
Server-side encryption is a feature in Amazon Kinesis Data Streams that automatically encrypts data before it`s at rest by using an AWS KMS customer master key (CMK) you specify. Data is encrypted before it`s written to the Kinesis stream storage layer, and decrypted after it’s retrieved from storage. As a result, your data is encrypted at rest within the Kinesis Data Streams service. This allows you to meet strict regulatory requirements and enhance the security of your data.
With server-side encryption, your Kinesis stream producers and consumers don`t need to manage master keys or cryptographic operations. Your data is automatically encrypted as it enters and leaves the Kinesis Data Streams service, so your data at rest is encrypted. AWS KMS provides all the master keys that are used by the server-side encryption feature. AWS KMS makes it easy to use a CMK for Kinesis that is managed by AWS, a user-specified AWS KMS CMK, or a master key imported into the AWS KMS service.
Options C and D are incorrect since the company does not want to manage the encryption process
Option A is incorrect since you need to use the KMS service for encryption of data
For more information on server-side encryption with Kinesis, please refer to the below URL
https://docs.aws.amazon.com/streams/latest/dev/what-is-sse.html