When it comes to auditing and monitoring database activity, Amazon Aurora‘s Database Activity Stream (DAS) provides a secure and near real-time stream of database activity. By default, DAS encrypts all data in transit using AWS Key Management Service (KMS) with a customer-managed key (CMK) and streams this encrypted data into a Serverless Streaming Data Service – Amazon Kinesis. 

While this is great for compliance and security, reading and interpreting the encrypted data stream requires additional effort — particularly if you’re building custom analytics, alerting, or logging solutions. This article walks you through how to read the encrypted Aurora DAS records from Kinesis using the AWS Encryption SDK.