Back to Checks
aws

Kinesis stream retains data for at least the required minimum hours

kinesis_stream_data_retention_period
Service: kinesisSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsKinesisStream

Kinesis Data Streams retention window is evaluated to confirm records are kept for at least the configured minimum duration (default 168 hours).

Prowler logoProwlerprowler-provider-aws

Risk

Insufficient retention causes records to expire before consumers read or reprocess them, undermining availability and analytics integrity. Backlogs or outages can create irreversible data gaps, hinder investigations and recovery, and enable denial-of-service-by-lag against event pipelines.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kinesis_stream_data_retention_period

Recommendation

Set the retention period to exceed worst-case consumer lag, replay needs, and compliance windows; use at least 168 hours by default (or customize as necessary) and raise as required. Enforce change control and least privilege on retention changes, monitor consumer lag, and maintain secondary durability (e.g., archival) for critical streams.

Remediation

CLI

aws kinesis increase-stream-retention-period --stream-name <example_resource_name> --retention-period-hours 168

Terraform

# Kinesis stream with adequate retention period
resource "aws_kinesis_stream" "<example_resource_name>" {
  name             = "<example_resource_name>"
  shard_count      = 1
  retention_period = 168  # critical: sets retention to >= 168 hours to pass the check
}

NativeIaC

# CloudFormation: set Kinesis stream retention to minimum required hours
Resources:
  <example_resource_name>:
    Type: AWS::Kinesis::Stream
    Properties:
      ShardCount: 1
      RetentionPeriodHours: 168  # critical: sets retention to >= 168 hours to pass the check

Other

1Sign in to the AWS Console and open Amazon Kinesis
2Go to Data streams and select <example_resource_name>
3Click Edit
4Set Retention period to 168 hours (or higher, per your policy)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kinesis.kinesis_client import kinesis_client


class kinesis_stream_data_retention_period(Check):
    """Ensure Kinesis Stream has an adequate data retention period

    The retention period for Kinesis Streams should be set to a value that meets the organization's data retention policy.
    """

    def execute(self):
        """Execute Check Kinesis Stream data retention period

        Iterate over all Kinesis Streams and check if the retention period is adequate.

        Returns:
            findings (list): List of findings
        """
        findings = []
        for stream in kinesis_client.streams.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=stream)
            report.status = "FAIL"
            report.status_extended = f"Kinesis Stream {stream.name} does not have an adequate data retention period ({stream.retention_period}hrs)."

            if stream.retention_period >= kinesis_client.audit_config.get(
                "min_kinesis_stream_retention_hours", 168
            ):
                report.status = "PASS"
                report.status_extended = f"Kinesis Stream {stream.name} does have an adequate data retention period ({stream.retention_period}hrs)."

            findings.append(report)

        return findings

References