A Kinesis Data Streams application stores clickstream data that may not be consumed for up to 12 hours. How can you enable encryption-at-rest for the data in the Kinesis stream?

Enabling server-side encryption (SSE) in Kinesis Data Streams is the correct method for encrypting data at rest. Kinesis SSE uses AWS Key Management Service (AWS KMS) keys to encrypt data as it is written to the stream and decrypts it when it is read. This ensures that the clickstream data is protected while stored within Kinesis, meeting the requirement for encryption at rest for up to 12 hours. Enabling SSL connections to Kinesis provides encryption in transit, not at rest. Using the Amazon Kinesis Consumer Library is for consuming data from the stream and does not inherently provide encryption at rest for the data within Kinesis. Encrypting data at rest later using a Lambda function is not a native Kinesis feature for at-rest encryption and would involve complex, custom processing after the data has already been stored unencrypted in Kinesis, which doesn't meet the direct requirement.