libZSservicesZSamazonka-kinesis-firehoseZSamazonka-kinesis-firehose
Copyright(c) 2013-2021 Brendan Hay
LicenseMozilla Public License, v. 2.0.
MaintainerBrendan Hay <brendan.g.hay+amazonka@gmail.com>
Stabilityauto-generated
Portabilitynon-portable (GHC extensions)
Safe HaskellNone

Amazonka.Firehose.StartDeliveryStreamEncryption

Description

Enables server-side encryption (SSE) for the delivery stream.

This operation is asynchronous. It returns immediately. When you invoke it, Kinesis Data Firehose first sets the encryption status of the stream to ENABLING, and then to ENABLED. The encryption status of a delivery stream is the Status property in DeliveryStreamEncryptionConfiguration. If the operation fails, the encryption status changes to ENABLING_FAILED. You can continue to read and write data to your delivery stream while the encryption status is ENABLING, but the data is not encrypted. It can take up to 5 seconds after the encryption status changes to ENABLED before all records written to the delivery stream are encrypted. To find out whether a record or a batch of records was encrypted, check the response elements PutRecordOutput$Encrypted and PutRecordBatchOutput$Encrypted, respectively.

To check the encryption status of a delivery stream, use DescribeDeliveryStream.

Even if encryption is currently enabled for a delivery stream, you can still invoke this operation on it to change the ARN of the CMK or both its type and ARN. If you invoke this method to change the CMK, and the old CMK is of type CUSTOMER_MANAGED_CMK, Kinesis Data Firehose schedules the grant it had on the old CMK for retirement. If the new CMK is of type CUSTOMER_MANAGED_CMK, Kinesis Data Firehose creates a grant that enables it to use the new CMK to encrypt and decrypt data and to manage the grant.

If a delivery stream already has encryption enabled and then you invoke this operation to change the ARN of the CMK or both its type and ARN and you get ENABLING_FAILED, this only means that the attempt to change the CMK failed. In this case, encryption remains enabled with the old CMK.

If the encryption status of your delivery stream is ENABLING_FAILED, you can invoke this operation again with a valid CMK. The CMK must be enabled and the key policy mustn't explicitly deny the permission for Kinesis Data Firehose to invoke KMS encrypt and decrypt operations.

You can enable SSE for a delivery stream only if it's a delivery stream that uses DirectPut as its source.

The StartDeliveryStreamEncryption and StopDeliveryStreamEncryption operations have a combined limit of 25 calls per delivery stream per 24 hours. For example, you reach the limit if you call StartDeliveryStreamEncryption 13 times and StopDeliveryStreamEncryption 12 times for the same delivery stream in a 24-hour period.

Synopsis

Creating a Request

data StartDeliveryStreamEncryption Source #

See: newStartDeliveryStreamEncryption smart constructor.

Constructors

StartDeliveryStreamEncryption' 

Fields

Instances

Instances details
Eq StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Read StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Show StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Generic StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Associated Types

type Rep StartDeliveryStreamEncryption :: Type -> Type #

NFData StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Hashable StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

ToJSON StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

AWSRequest StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

ToHeaders StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

ToPath StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

ToQuery StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

type Rep StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

type Rep StartDeliveryStreamEncryption = D1 ('MetaData "StartDeliveryStreamEncryption" "Amazonka.Firehose.StartDeliveryStreamEncryption" "libZSservicesZSamazonka-kinesis-firehoseZSamazonka-kinesis-firehose" 'False) (C1 ('MetaCons "StartDeliveryStreamEncryption'" 'PrefixI 'True) (S1 ('MetaSel ('Just "deliveryStreamEncryptionConfigurationInput") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe DeliveryStreamEncryptionConfigurationInput)) :*: S1 ('MetaSel ('Just "deliveryStreamName") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text)))
type AWSResponse StartDeliveryStreamEncryption Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

newStartDeliveryStreamEncryption Source #

Create a value of StartDeliveryStreamEncryption with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:deliveryStreamEncryptionConfigurationInput:StartDeliveryStreamEncryption', startDeliveryStreamEncryption_deliveryStreamEncryptionConfigurationInput - Used to specify the type and Amazon Resource Name (ARN) of the KMS key needed for Server-Side Encryption (SSE).

$sel:deliveryStreamName:StartDeliveryStreamEncryption', startDeliveryStreamEncryption_deliveryStreamName - The name of the delivery stream for which you want to enable server-side encryption (SSE).

Request Lenses

startDeliveryStreamEncryption_deliveryStreamEncryptionConfigurationInput :: Lens' StartDeliveryStreamEncryption (Maybe DeliveryStreamEncryptionConfigurationInput) Source #

Used to specify the type and Amazon Resource Name (ARN) of the KMS key needed for Server-Side Encryption (SSE).

startDeliveryStreamEncryption_deliveryStreamName :: Lens' StartDeliveryStreamEncryption Text Source #

The name of the delivery stream for which you want to enable server-side encryption (SSE).

Destructuring the Response

data StartDeliveryStreamEncryptionResponse Source #

Constructors

StartDeliveryStreamEncryptionResponse' 

Fields

Instances

Instances details
Eq StartDeliveryStreamEncryptionResponse Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Read StartDeliveryStreamEncryptionResponse Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Show StartDeliveryStreamEncryptionResponse Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

Generic StartDeliveryStreamEncryptionResponse Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

NFData StartDeliveryStreamEncryptionResponse Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

type Rep StartDeliveryStreamEncryptionResponse Source # 
Instance details

Defined in Amazonka.Firehose.StartDeliveryStreamEncryption

type Rep StartDeliveryStreamEncryptionResponse = D1 ('MetaData "StartDeliveryStreamEncryptionResponse" "Amazonka.Firehose.StartDeliveryStreamEncryption" "libZSservicesZSamazonka-kinesis-firehoseZSamazonka-kinesis-firehose" 'False) (C1 ('MetaCons "StartDeliveryStreamEncryptionResponse'" 'PrefixI 'True) (S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int)))

newStartDeliveryStreamEncryptionResponse Source #

Create a value of StartDeliveryStreamEncryptionResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:httpStatus:StartDeliveryStreamEncryptionResponse', startDeliveryStreamEncryptionResponse_httpStatus - The response's http status code.

Response Lenses