AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Enables or updates server-side encryption using an Amazon Web Services KMS key for
a specified stream.
When invoking this API, you must use either the StreamARN or the StreamName
parameter, or both. It is recommended that you use the StreamARN input parameter
when you invoke this API.
Starting encryption is an asynchronous operation. Upon receiving the request, Kinesis
Data Streams returns immediately and sets the status of the stream to UPDATING.
After the update is complete, Kinesis Data Streams sets the status of the stream back
to ACTIVE. Updating or applying encryption normally takes a few seconds to
complete, but it can take minutes. You can continue to read and write data to your
stream while its status is UPDATING. Once the status of the stream is ACTIVE,
encryption begins for records written to the stream.
API Limits: You can successfully apply a new Amazon Web Services KMS key for server-side encryption 25 times in a rolling 24-hour period.
Note: It can take up to 5 seconds after the stream is in an ACTIVE status before
all records written to the stream are encrypted. After you enable encryption, you
can verify that encryption is applied by inspecting the API response from PutRecord
or PutRecords.
This is an asynchronous operation using the standard naming convention for .NET 4.5 or higher. For .NET 3.5 the operation is implemented as a pair of methods using the standard naming convention of BeginStartStreamEncryption and EndStartStreamEncryption.
Namespace: Amazon.Kinesis
Assembly: AWSSDK.Kinesis.dll
Version: 3.x.y.z
public abstract Task<StartStreamEncryptionResponse> StartStreamEncryptionAsync( StartStreamEncryptionRequest request, CancellationToken cancellationToken )
Container for the necessary parameters to execute the StartStreamEncryption service method.
A cancellation token that can be used by other objects or threads to receive notice of cancellation.
| Exception | Condition |
|---|---|
| AccessDeniedException | Specifies that you do not have the permissions required to perform this operation. |
| InvalidArgumentException | A specified parameter exceeds its restrictions, is not supported, or can't be used. For more information, see the returned message. |
| KMSAccessDeniedException | The ciphertext references a key that doesn't exist or that you don't have access to. |
| KMSDisabledException | The request was rejected because the specified customer master key (CMK) isn't enabled. |
| KMSInvalidStateException | The request was rejected because the state of the specified resource isn't valid for this request. For more information, see How Key State Affects Use of a Customer Master Key in the Amazon Web Services Key Management Service Developer Guide. |
| KMSNotFoundException | The request was rejected because the specified entity or resource can't be found. |
| KMSOptInRequiredException | The Amazon Web Services access key ID needs a subscription for the service. |
| KMSThrottlingException | The request was denied due to request throttling. For more information about throttling, see Limits in the Amazon Web Services Key Management Service Developer Guide. |
| LimitExceededException | The requested resource exceeds the maximum number allowed, or the number of concurrent stream requests exceeds the maximum number allowed. |
| ResourceInUseException | The resource is not available for this operation. For successful operation, the resource must be in the ACTIVE state. |
| ResourceNotFoundException | The requested resource could not be found. The stream might not be specified correctly. |
.NET:
Supported in: 8.0 and newer, Core 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.5 and newer