View a markdown version of this page

Data protection in Amazon Managed Service for Apache Flink - Managed Service for Apache Flink
Data encryption

Data protection in Amazon Managed Service for Apache Flink

You can protect your data using tools that are provided by AWS. Amazon MSF can work with services that support encrypting data, including Firehose, and Amazon S3.

Data encryption in Managed Service for Apache Flink

Encryption at rest

Note the following about encrypting data at rest with Amazon MSF:

  • You can encrypt data on the incoming Kinesis data stream using StartStreamEncryption. For more information, see What Is Server-Side Encryption for Kinesis Data Streams?.

  • Output data can be encrypted at rest using Firehose to store data in an encrypted Amazon S3 bucket. You can specify the encryption key that your Amazon S3 bucket uses. For more information, see Protecting Data Using Server-Side Encryption with KMS–Managed Keys (SSE-KMS).

  • Amazon MSF can read from any streaming source, and write to any streaming or database destination. Ensure that your sources and destinations encrypt all data in transit and data at rest.

  • Your application's code is encrypted at rest.

  • Durable application storage is encrypted at rest.

  • Running application storage is encrypted at rest.

  • Managed Service for Apache Flink encrypts enhanced snapshots at rest with an AWS owned key or a customer managed key. An enhanced snapshot that an application creates uses the key of that application. An imported enhanced snapshot uses the key that you set in the ImportSnapshot request. If you do not set a key, Managed Service for Apache Flink uses an AWS owned key. For more information, see How enhanced snapshots work.

  • Managed Service for Apache Flink encrypts exported enhanced snapshots in your Amazon S3 bucket with the key that you set in the ExportSnapshot request. If you set AWS_OWNED_KEY, Amazon S3 applies the default encryption of the destination bucket. For more information, see Encryption for imported and exported snapshots.

Encryption in transit

Amazon MSF encrypts all data in transit. Encryption in transit is enabled for all Amazon MSF applications and cannot be disabled.

Amazon MSF encrypts data in transit in the following scenarios:

  • Data in transit from Kinesis Data Streams to Amazon MSF.

  • Data in transit between internal components within Amazon MSF.

  • Data in transit between Amazon MSF and Firehose.

Key management

In Amazon MSF, you can use either service managed or your own customer managed keys to encrypt data. For more information, see Key management in Amazon Managed Service for Apache Flink.