The need to securely store sensitive health information is paramount. [The Health Insurance Portability and Accountability Act](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act{externalnofollow}) (HIPAA) is not only a legal requirement but also a fundamental part of safeguarding patient privacy and data security for organizations in the healthcare sector. As healthcare providers increasingly transition to digital records and cloud-based solutions, the demand for HIPAA-compliant cloud storage services has never been higher. These services not only ensure compliance but also offer enhanced data security, accessibility, and scalability, making them a valuable asset for healthcare organizations.

HIPAA sets stringent standards for protecting patients' electronic protected health information [(ePHI)](https://www.techtarget.com/searchhealthit/definition/electronic-protected-health-information-ePHI{externalnofollow}), requiring healthcare organizations to implement comprehensive safeguards to ensure confidentiality, integrity, and availability. However, navigating the complex landscape of HIPAA compliance, with its numerous rules and regulations, can be daunting, especially when selecting the right cloud storage provider. This complexity underscores the need for expert guidance and solutions that can simplify the process.

Here, we explore HIPAA compliance in cloud storage solutions and highlight key considerations for healthcare organizations seeking secure and reliable platforms for storing their sensitive data. From encryption protocols to access controls and audit trails, we will delve into the essential features that distinguish HIPAA-compliant cloud storage services and help healthcare providers mitigate the risks associated with data breaches and regulatory non-compliance.

## What is HIPAA-Compliant Cloud Storage?

HIPAA, short for the Health Insurance Portability and Accountability Act, was established in 1996 with the aim of safeguarding patients' confidential health data. In response to the changing landscape of cybersecurity threats and growing concerns surrounding consumer privacy and data rights, updates have been made to HIPAA, including [the HIPAA Omnibus Rules](https://compliancy-group.com/hipaa-omnibus-rule/{externalnofollow}) and [the Health Information Technology for Economic and Clinical Health](https://en.wikipedia.org/wiki/Health_Information_Technology_for_Economic_and_Clinical_Health_Act{externalnofollow}) (HITECH).

Under HIPAA regulations, the disclosure of [protected health information](https://en.wikipedia.org/wiki/Protected_health_information{externalnofollow}) (PHI) is prohibited without explicit consent from the patient. Regardless of whether a company is directly involved in providing healthcare services, adherence to HIPAA guidelines is mandatory. Compliance entails ensuring privacy, security, breach notification, and enforcement, particularly for organizations operating in the cloud environment.

A HIPAA-compliant cloud storage system operates according to specific protocols, including data classification, encryption, two-factor authentication, audit trails, access monitoring, and administrative controls. These measures guarantee the highest level of data security and compliance with HIPAA standards. Additionally, cloud storage providers must issue Business Associate Agreements (BAAs) governing their relationship with end users before any PHI is uploaded, stored, or utilized.

**Read more about <u>[SaaS Solutions for the Healthcare Industry.](https://www.ecdevstudio.com/blog/saas-solutions-for-the-healthcare-industry/)</u>**

## What does the organization need to do to be HIPAA-compliant?

To achieve HIPAA compliance, organizations handling PHI must ensure their overall implementation and management of tech tools align with HIPAA regulations. While tech platforms themselves can't be inherently HIPAA compliant, adherence depends on how companies integrate and utilize these platforms within their systems. Even if a cloud storage solution meets HIPAA requirements, it's the responsibility of the organization using it to deploy it correctly and ensure its compatibility with other systems in a HIPAA-compliant manner.

Many cloud storage providers market themselves as supportive of HIPAA compliance, highlighting their adherence to regulations. However, they can't control how their technology is ultimately used by their customers. Therefore, the onus of HIPAA compliance lies with the organizations themselves. Nevertheless, numerous HIPAA-compliant data storage providers offer educational resources and support programs to assist users in implementing storage solutions appropriately while maintaining compliance, providing valuable guidance and assistance along the way.

## The 5 Best HIPAA-Compliant Cloud Storage Solutions

### 1. [Google Cloud](https://cloud.google.com/security/compliance/hipaa{externalnofollow})

The entirety of the G Suite, which includes Google Drive, is acknowledged as a platform compliant with HIPAA regulations. However, to ensure compliance, non-essential services within the suite need to be deactivated. Apart from the internal security measures taken by the company, Google Cloud aids in compliance by promoting the adoption of HIPAA best practices such as identity and access management, robust encryption methods, version and access controls, and maintaining detailed audit logs. As evidence of their commitment to compliance, Google Cloud offers users various industry-standard audits and certifications, such as ISO 27001, ISO 27017, SSAE16/ISAE 3402 Type II, ISO 27018, FedRAMP ATO, and PCI DSS v3.2.1.

### 2. [Dropbox](https://www.dropbox.com/business/trust/compliance/HIPAA{externalnofollow})

Dropbox aids in maintaining HIPAA compliance by providing users with comprehensive security guidelines. These include customizing sharing permissions, restricting permanent file deletion, monitoring account access and user activities, and assessing the compliance implications of third-party applications and integrations. Similar to other HIPAA-compliant storage options, Dropbox offers third-party reports to demonstrate its adherence to HIPAA regulations internally.

### 3. [Microsoft OneDrive](https://compliancy-group.com/onedrive-hipaa-compliant/{externalnofollow})

Pioneering in cloud service provision with BAAs tailored for healthcare, Microsoft encompasses a suite of services, including Office 365, OneDrive for Business, Azure, Dynamics 365, and PowerBI. Upholding HIPAA compliance, the company employs robust security measures such as 256-bit AES encryption and 2048-bit keys for SSI/TLS connections, alongside holding ISO/IEC 27001 and HITRUST CSF certifications. Moreover, Microsoft mandates that all its vendors and subcontractors adhere to identical HIPAA-compliant standards and limitations concerning PHI.

### 4. [Box](https://www.box.com/industries/healthcare/hipaa-compliance{externalnofollow})

HIPAA, HITECH, and HIPAA Omnibus Rule compliance are all highlighted as advantages of Box's cloud storage and file-sharing service. Box is often a top choice for healthcare providers because it allows secure viewing of DICOM medical files, such as X-rays, ultrasound images, and CT scans. Data encryption, access restrictions, activity reports, and audit trails are also included as part of the solution's HIPAA compliance. Box also provides disaster mitigation services using mirrored, active-active data centers.

### 5. [Carbonite](https://support.carbonite.com/articles/Appliance-Pro-Server-HIPAA{externalnofollow})

As one of the leading HIPAA-compliant cloud backup solutions since 2005 (when deployed correctly), Carbonite supports HIPAA compliance. Its HIPAA-compliant security features are 256-bit AES encryption for data in storage, Transport Layer Security for data in transit, and data deduplication across data sets. Furthermore, Carbonite helps prevent human error by transparently encrypting PHI, offering read/write access controls, and enabling port lockdowns to prevent unauthorized access.

**Also, read <u>[Online Health Transformation: Designing Effective Medical Websites.](https://www.ecdevstudio.com/blog/online-health-transformation-designing-effective-medical-websites/)</u>**

## Final Thoughts

IT professionals aren't all up to speed on the best ways to implement cloud technology, but cloud computing and cloud storage can help businesses achieve incredible results. [EcDev Studio can help with that!](https://www.ecdevstudio.com/) Find out how your company can implement cloud-native applications that are HIPAA compliant.

Feel free to [contact us](https://calendly.com/ecdev-studio/discovery-meeting?month=2024-05) to schedule a no-pressure meeting about HIPAA compliance for your cloud storage!


😉 Discover the top HIPAA-compliant cloud storage services for safeguarding sensitive health data. Learn key considerations, features, and best practices for HIPAA compliance in cloud storage solutions.

medium_HIPAA.png

small_HIPAA.png

thumbnail_HIPAA.png

HIPAA.png

HIPAA-Compliant Cloud Storage Services

Ensuring data protection is a critical priority, especially for B2B companies entrusted with sensitive information. GDPR is a beacon of privacy rights, shaping how businesses handle and secure personal information. However, achieving GDPR compliance is not a one-size-fits-all task, particularly for B2B operations. This comprehensive guide will delve into tailored GDPR compliance solutions, underlining their importance for B2B companies.

## Understanding GDPR Compliance for B2B Companies

Before delving into solutions, let’s establish a solid understanding of GDPR and its implications for B2B operations. GDPR mandates stringent rules governing personal data collection, processing, and storage. While the core principles apply universally, nuances exist between B2B and B2C data processing. B2B companies often deal with complex data ecosystems involving multiple stakeholders and third-party interactions, necessitating a tailored approach to compliance.

## Challenges Faced by B2B Companies in GDPR Compliance

B2B entities face unique challenges as they strive for GDPR compliance excellence. The intricacies of data management pose formidable obstacles, especially when it comes to the seamless flow of information among partners and across international borders. Unlike B2C interactions, where data often originates from direct customer interactions, B2B data ecosystems are characterized by multifaceted relationships, intricate contracts, and diverse data sources, amplifying the complexity of compliance efforts.

In addition to managing internal data flows, B2B companies must ensure compliance throughout their intricate supply chains. Collaborating with numerous vendors, contractors, and service providers introduces layers of complexity, each requiring rigorous scrutiny to guarantee adherence to GDPR principles. From due diligence in selecting compliant partners to establishing robust contractual agreements, every step in the supply chain must align with GDPR standards to prevent regulatory breaches and safeguard sensitive data.

Managing data subject requests presents another formidable challenge for B2B companies. Unlike the relatively straightforward nature of consumer-facing businesses, where individual data subjects typically interact directly with the organization, B2B entities often grapple with diverse stakeholders representing corporate entities. Responding to data subject access requests (DSARs) demands meticulous attention to detail, efficient communication channels, and robust systems for verifying identities and processing requests within the mandated timelines.

Moreover, the repercussions of non-compliance cast a shadow over B2B companies. Beyond the threat of substantial fines, which can reach millions of euros or a percentage of global turnover, non-compliance erodes trust and credibility in the eyes of clients, partners, and regulators. Business relationships and market competitiveness can be undermined by a single data breach or regulatory violation. Hence, the stakes are high, compelling B2B companies to view GDPR compliance as a strategic imperative rather than a mere regulatory obligation.

## Tailored Solutions for B2B GDPR Compliance

In the intricate landscape of GDPR compliance, B2B companies must deploy tailored solutions that address the unique challenges inherent in their operations. Building upon robust data protection policies and procedures, organizations can fortify their compliance efforts through a multifaceted approach encompassing technological innovation, procedural enhancements, and continuous monitoring.

### 1. Comprehensive Data Protection Policies and Procedures:

B2B companies must establish comprehensive data protection policies and procedures delineating clear guidelines for handling personal data across all operations. These policies should encompass data collection, processing, storage, and disposal, aligning closely with GDPR principles such as lawfulness, fairness, and transparency. Organizations can ensure consistency and accountability throughout their data lifecycle by outlining clear protocols for data handling.

### 2. Advanced Encryption Protocols:

Encryption prevents unauthorized parties from deciphering sensitive information. To protect personal data at rest and in transit, B2B companies should implement advanced encryption protocols. End-to-end encryption protects data from when it is collected to when it is stored, preventing unauthorized access.

### 3. Granular Access Controls:

Granular access controls empower B2B companies to manage and restrict access to personal data based on predefined roles and permissions. In order to ensure compliance with least privilege principles, organizations should implement role-based access controls (RBAC). This enhances data security and facilitates compliance with GDPR requirements about data minimization and access restriction.

### 4. Data Anonymization Techniques:

In situations where the processing of personal data is unnecessary for a specific purpose, B2B companies can leverage data anonymization techniques to mitigate privacy risks. By anonymizing or pseudonymizing personal data, organizations can retain its utility for analytical or research purposes while minimizing the risk of reidentification. Anonymization techniques such as hashing, tokenization, and differential privacy offer versatile solutions for protecting privacy without compromising data utility.

### 5. Continuous Data Audits and Monitoring:

Regular data audits and monitoring mechanisms are essential to a proactive compliance strategy. B2B companies should conduct comprehensive audits of their data processing activities to identify vulnerabilities, assess compliance gaps, and implement remedial measures. Monitoring tools can provide real-time insight into data flows, access patterns, and potential security incidents, enabling organizations to respond quickly to emerging threats.

By embracing these tailored solutions, B2B companies can confidently navigate the complexities of GDPR compliance, safeguard personal data, and foster trust among clients, partners, and regulators alike. Compliance isn't merely a box-ticking exercise but a strategic imperative that drives business resilience and sustainability in an increasingly data-driven world. It's not just about avoiding fines, but about protecting your reputation, maintaining client trust, and staying competitive in the market.

## Partnering with GDPR Compliance Experts

In the complex realm of GDPR compliance, B2B companies often grapple with intricate regulatory requirements, evolving privacy landscapes, and complex data ecosystems. Recognizing the formidable challenges at hand, many organizations turn to GDPR compliance experts for their unparalleled expertise, strategic support, and guidance. Collaborating with these seasoned professionals specializing in B2B GDPR compliance not only streamlines the compliance journey but also enhances organizational resilience, fosters trust, and mitigates regulatory risks.

#### 1. Comprehensive Compliance Assessment:

Partnering with GDPR compliance experts initiates a comprehensive assessment of the organization's current compliance posture. Seasoned professionals conduct in-depth audits, gap analyses, and risk assessments to identify areas of non-compliance, vulnerabilities, and opportunities for improvement. By gaining a holistic understanding of the organization's data processing activities, compliance gaps, and industry-specific challenges, compliance experts lay the groundwork for tailored solutions that address the organization's unique needs and objectives.

#### 2. Tailored Compliance Roadmap:

Armed with insights garnered from the compliance assessment, GDPR compliance experts craft a tailored compliance roadmap that delineates clear steps, milestones, and timelines for achieving and maintaining compliance. This roadmap encompasses a multipronged approach encompassing policy refinement, technology optimization, process enhancements, and organizational capacity-building initiatives. By aligning compliance efforts with business objectives and regulatory imperatives, compliance experts empower organizations to navigate the complexities of GDPR compliance with confidence and clarity.

#### 3. Specialized Expertise and Guidance:

One key advantage of partnering with GDPR compliance experts is gaining access to specialized expertise and guidance tailored to the intricacies of B2B operations. These professionals possess an in-depth understanding of industry-specific challenges, regulatory nuances, and best practices honed through years of experience navigating the evolving data protection landscape. From data mapping and classification to vendor management and international data transfers, compliance experts provide strategic guidance and practical solutions that align with the organization's strategic objectives and regulatory obligations.

#### 4. Proactive Risk Management:

Proactive risk management is paramount in the ever-evolving realm of data protection. GDPR compliance experts leverage their expertise and industry insights to anticipate emerging threats, regulatory changes, and compliance risks, enabling organizations to stay ahead of the curve and mitigate potential liabilities. Businesses can prevent compliance gaps, vulnerabilities, and resilience by proactively identifying and addressing compliance gaps, vulnerabilities, and emerging trends through continuous monitoring, analysis, and adaptation.

#### 5. Strategic Partnership for Long-Term Success:

Beyond transactional engagements, partnering with GDPR compliance experts fosters a strategic partnership for long-term success. These professionals serve as trusted advisors, collaborators, and advocates, guiding organizations through the intricacies of GDPR compliance and empowering them to leverage data as a strategic asset for innovation, growth, and competitive advantage. By aligning compliance efforts with broader business objectives, compliance experts enable organizations to unlock the full potential of data while safeguarding privacy rights and fostering trust among stakeholders.

Partnering with GDPR compliance experts is more than a prudent choice for B2B companies; it's a strategic imperative. By leveraging specialized expertise, tailored solutions, and strategic guidance, organizations can navigate the complexities of GDPR compliance with confidence, resilience, and clarity while unlocking the full potential of data as a driver of innovation, growth, and sustainable success.

## Implementing a Culture of Compliance

In the quest for GDPR compliance excellence, B2B companies must recognize that compliance isn't merely a checkbox exercise but a holistic endeavor that requires a cultural shift towards prioritizing data protection and privacy at every level of the organization. Implementing a robust culture of compliance goes beyond technical solutions, encompassing educational initiatives, organizational practices, and leadership commitment to instill a shared ethos of accountability, transparency, and continuous improvement.

**- Comprehensive Employee Training Programs:**

At the heart of fostering a culture of compliance lies comprehensive employee training programs that equip staff with the knowledge, skills, and awareness necessary to navigate the complexities of GDPR requirements effectively. These programs should cover many things, including data protection principles, GDPR, organizational policies and procedures, incident response protocols, and the importance of safeguarding personal data. Organizations cultivate a vigilant, informed, and proactive workforce to uphold data protection standards by empowering employees with the requisite knowledge and understanding.

**- Ongoing Awareness Campaigns:**

In addition to formal training programs, B2B companies should implement ongoing awareness campaigns to reinforce key messages, promote best practices, and foster a culture of vigilance and responsibility. Through regular communications, newsletters, workshops, and interactive sessions, organizations can engage employees in discussions about data protection, privacy rights, and the importance of compliance in maintaining trust and credibility with clients, partners, and regulators. By integrating data protection into the organizational fabric, awareness campaigns create a shared sense of ownership and commitment to upholding GDPR principles.

**- Leadership Commitment and Role Modeling:**

Influential compliance culture begins at the top, with leadership commitment and role modeling setting the tone for organizational behavior and priorities. Senior executives and managers should demonstrate unwavering commitment to data protection and compliance, leading by example through their actions, decisions, and communications. By visibly championing compliance initiatives, allocating resources, and embedding compliance considerations into strategic planning and decision-making processes, leaders cultivate a culture where compliance is not an impediment but a strategic enabler for business success.

**- Regular Assessments and Performance Metrics:**

Sustaining a culture of compliance requires ongoing evaluation and measurement of organizational performance against established standards and objectives. B2B companies should conduct regular assessments, audits, and performance reviews to gauge compliance maturity, identify areas for improvement, and track progress over time. Key performance indicators (KPIs) and metrics, such as training completion rates, incident response times, and compliance audit findings, provide valuable insights into the effectiveness of compliance initiatives and areas requiring additional attention or investment.

**- Continuous Improvement Initiatives:**

Building a culture of compliance is an iterative process that demands continuous learning, adaptation, and improvement. B2B companies should foster innovation and continuous improvement, encouraging employees to proactively identify and address compliance challenges, propose solutions, and share best practices. In order to drive meaningful change and innovation in compliance practices, organizations can leverage feedback mechanisms, employee surveys, and cross-functional collaboration.

Implementing a culture of compliance is foundational to sustainable GDPR adherence for B2B companies. By investing in comprehensive employee training programs, ongoing awareness campaigns, leadership commitment, regular assessments, and continuous improvement initiatives, organizations can cultivate a compliance-conscious culture that meets regulatory requirements and fosters trust, accountability, and resilience in an increasingly data-driven world. Compliance isn't just a set of rules—it's a mindset, a commitment, and a shared responsibility that permeates every aspect of organizational behavior and decision-making.

## Final Words

GDPR compliance is not a choice but necessary for B2B companies aiming to thrive in today’s data-driven economy. By understanding their unique challenges and implementing tailored compliance solutions, B2B organizations can safeguard sensitive data, mitigate risks, and build trust with clients and partners. 
Remember, compliance is an ongoing journey, and prioritizing data protection is key to long-term success in the digital age. 
Take proactive steps today to secure your business and uphold privacy rights for all stakeholders.


Explore tailored GDPR compliance solutions for B2B companies, addressing unique challenges in data protection. From encryption protocols to culture of compliance, learn how to navigate GDPR intricacies effectively.

GDPR compliance solutions for B2B companies.png

large_GDPR compliance solutions for B2B companies.png

medium_GDPR compliance solutions for B2B companies.png

small_GDPR compliance solutions for B2B companies.png

thumbnail_GDPR compliance solutions for B2B companies.png

GDPR Compliance Solutions for B2B Companies

🏢 Discover the transformative power of Enterprise Business Intelligence (BI) in driving informed decision-making and gaining a competitive edge. Learn key components, benefits, challenges, and best practices from real-world examples across industries like healthcare, retail, finance, and manufacturing.

large_bi (1).png

medium_bi (1).png

small_bi (1).png

thumbnail_bi (1).png

bi (1).png

Enterprise Business Intelligence

In a lot of real life scenarios, services need to store information in databases tables. The tables contain critical information, where changes need to be tracked for security, accountability and regulatory requirements. Typically, this sort of action is not time critical, so adding an audit trail with the same availability and access times as the rest of your application is not advised, especially if you don't want your costs to increase unexpectedly.

In this blog post I will detail an example of how to extract changes made to an Amazon DynamoDB table and store the audit trail of those changes in an Amazon S3 (Amazon Simple Storage Service) bucket, making use of AWS Kinesis Data Stream and AWS Kinesis Firehose.

## Architecture

![afe2af11-e264-48ab-825c-4b24ac957eb1.png](https://ecdev-cms-dev-ecdev-cms-ecdev-cms-bucket.s3.us-west-1.amazonaws.com/uploads/2022/9/10/afe2af11_e264_48ab_825c_4b24ac957eb1_ec971b9cc2.png)

### Change data streaming

On the initial step of our design, an AWS Kinesis Data Stream is attached to the Amazon DynamoDB table. What this means is, every time a new change happens in the table, that change is captured and kept in a data stream.

The format of the data sent includes: a timestamp of the captured change, the primary key (will be the partitionKey + sortKey), and a before and after image of the changed item. With the before and after, it's possible to understand what particular values have changed.

After this, a consumer, in this case, AWS Kinesis Firehose, must retrieve data from this stream. Its only purpose on the architecture is to retrieve data from the AWS Kinesis Data Stream and into an Amazon S3 bucket.

### Audit trail storage

When data reaches the Amazon S3 bucket, we could leave it as is and be done with this example, but in order to reduce costs of such a solution, we're going to use Amazon S3 lifecycle rules.

Lifecycle rules allow us to move older data to cheaper storage classes progressively and in an automated fashion. The reasoning behind this is, most recent auditing data is the most likely to be accessed, and older data should still be accessible, but we can live with it taking longer to get. This should be tweaked according to your use case.

## Building the infrastructure

### Using AWS CDK to deploy infrastructure

This post assumes you have AWS CDK Toolkit. You should have an AWS account created.

Amazon offers an Infrastructure-As-Code solution, called AWS Cloud Development Kit, or CDK for short. It uses AWS Cloudformation internally to define infrastructure in a reviewable, deployable manner. CDK is offered in multiple languages, we'll use Typescript in this example.

#### AWS CDK setup

Assuming you already have CDK Toolkit installed, create a folder for the CDK code and initialise the project:


```
mkdir audit-trail-cdk
cd audit-trail-cdk && cdk init app --language typescript  
```

cdk init app builds the initial scaffolding for the project. It creates a Stack, which will contain the pieces of infrastructure required. To finish up the setup, go to the generated code for the stack under bin/audit-trail-cdk.ts and uncomment the env: line and replace with your AWS account info:


```
// env: { account: '123456789012', region: 'us-east-1' }, 
```

Let's add the necessary pieces for building our infrastructure stack on lib/audit-trail-cdk-stack.ts:


```
import * as cdk from "aws-cdk-lib";
import { Duration } from "aws-cdk-lib";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as iam from "aws-cdk-lib/aws-iam";
import * as kinesis from "aws-cdk-lib/aws-kinesis";
import * as kinesisfirehose from "aws-cdk-lib/aws-kinesisfirehose";
import * as s3 from "aws-cdk-lib/aws-s3";
import { Construct } from "constructs";

export class SimpleAwsAuditTrailStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const auditTrailStream = new kinesis.Stream(this, "Stream");

    new dynamodb.Table(this, "TableToAudit", {
      tableName: `TableToAudit`,
      partitionKey: {
        name: "partitionKey",
        type: dynamodb.AttributeType.STRING,
      },
      sortKey: {
        name: "sortKey",
        type: dynamodb.AttributeType.STRING,
      },
      kinesisStream: auditTrailStream,
    });

    const auditTrailBucket = new s3.Bucket(this, "AuditTrailDestination", {
      lifecycleRules: [
        {
          transitions: [
            {
              storageClass: s3.StorageClass.INFREQUENT_ACCESS,
              transitionAfter: Duration.days(30),
            },
            {
              storageClass: s3.StorageClass.INTELLIGENT_TIERING,
              transitionAfter: Duration.days(60),
            },
            {
              storageClass: s3.StorageClass.GLACIER,
              transitionAfter: Duration.days(90),
            },
            {
              storageClass: s3.StorageClass.DEEP_ARCHIVE,
              transitionAfter: Duration.days(180),
            },
          ],
        },
      ],
    });

    const deliveryRole = new iam.Role(this, "deliveryRole", {
      assumedBy: new iam.ServicePrincipal("firehose.amazonaws.com"),
      inlinePolicies: {
        s3: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              resources: [
                `arn:aws:s3:::${auditTrailBucket.bucketName}`,
                `arn:aws:s3:::${auditTrailBucket.bucketName}/*`,
              ],
              actions: [
                "s3:AbortMultipartUpload",
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:PutObject",
              ],
            }),
          ],
        }),
        kinesis: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              resources: [auditTrailStream.streamArn],
              actions: [
                "kinesis:DescribeStream",
                "kinesis:GetShardIterator",
                "kinesis:GetRecords",
                "kinesis:ListShards",
              ],
            }),
          ],
        }),
        logs: new iam.PolicyDocument({
          statements: [
            new iam.PolicyStatement({
              resources: ["*"],
              actions: ["logs:PutLogEvents"],
            }),
          ],
        }),
      },
    });

    new kinesisfirehose.CfnDeliveryStream(this, "DeliveryStream", {
      deliveryStreamType: "KinesisStreamAsSource",
      kinesisStreamSourceConfiguration: {
        roleArn: deliveryRole.roleArn,
        kinesisStreamArn: auditTrailStream.streamArn,
      },
      s3DestinationConfiguration: {
        bucketArn: auditTrailBucket.bucketArn,
        roleArn: deliveryRole.roleArn,
      },
    });
  }
}
```

### Understanding the infrastructure code

The code tries to emulate the architecture diagram as much as possible, but let's go through it in more detail:
1. Create an AWS Kinesis Data Stream.
2. Create an Amazon DynamoDB table and add the AWS Kinesis Data Stream created in the previous step.
3. Create the Amazon S3 bucket, and define on it the lifecycle rules.
4. Create the AWS IAM role to be used by AWS Kinesis Firehose. The role needs to have permissions to retrieve data from the AWS Kinesis Data Stream, and to store data in the AWS S3 bucket.
5. Create the AWS Kinesis Firehose resource, with reference to the data stream and the S3 bucket.

## Testing the solution

Let's create a record in the Amazon DynamoDB and make a change, to see what the data in the AWS S3 bucket looks like.

```
aws dynamodb put-item  \
--table-name TableToAudit \
--item '{"partitionKey": {"S": "1"}, "sortKey": {"S": "State"}, "Data": {"S": "Initial state"}}'

aws dynamodb put-item  \
--table-name TableToAudit \
--item '{"partitionKey": {"S": "1"}, "sortKey": {"S": "State"}, "Data": {"S": "Changed state"}}'
```

At this point, the Amazon DynamoDB table should look like this:

![0481cd29-9829-4173-9dcf-744e568839ba.png](https://ecdev-cms-dev-ecdev-cms-ecdev-cms-bucket.s3.us-west-1.amazonaws.com/uploads/2022/9/10/0481cd29_9829_4173_9dcf_744e568839ba_f89ce2951f.png)

Let's see what the data looks like on the Amazon S3 bucket, inside a file.

![fa79e3ec-9c1b-4008-b1a4-d7ce17bba922.png](https://ecdev-cms-dev-ecdev-cms-ecdev-cms-bucket.s3.us-west-1.amazonaws.com/uploads/2022/9/10/fa79e3ec_9c1b_4008_b1a4_d7ce17bba922_9aac2f6b93.png)


```
{
  "awsRegion": "us-east-1",
  "eventID": "65eed7c0-4c74-4e71-b443-3b68b28f9455",
  "eventName": "INSERT",
  "userIdentity": null,
  "recordFormat": "application/json",
  "tableName": "TableToAudit",
  "dynamodb": {
    "ApproximateCreationDateTime": 1662992934392,
    "Keys": { "sortKey": { "S": "State" }, "partitionKey": { "S": "1" } },
    "NewImage": {
      "sortKey": { "S": "State" },
      "Data": { "S": "Initial state" },
      "partitionKey": { "S": "1" }
    },
    "SizeBytes": 67
  },
  "eventSource": "aws:dynamodb"
}
{
  "awsRegion": "us-east-1",
  "eventID": "55c911a3-d0a6-4d23-99ab-c1fd3e4d01b5",
  "eventName": "MODIFY",
  "userIdentity": null,
  "recordFormat": "application/json",
  "tableName": "TableToAudit",
  "dynamodb": {
    "ApproximateCreationDateTime": 1662992947714,
    "Keys": { "sortKey": { "S": "State" }, "partitionKey": { "S": "1" } },
    "NewImage": {
      "sortKey": { "S": "State" },
      "Data": { "S": "Changed state" },
      "partitionKey": { "S": "1" }
    },
    "OldImage": {
      "sortKey": { "S": "State" },
      "Data": { "S": "Initial state" },
      "partitionKey": { "S": "1" }
    },
    "SizeBytes": 109
  },
  "eventSource": "aws:dynamodb"
}
```

As you can see, there's data about each change in a [JSON Lines](https://jsonlines.org/{externalnofollow}) format, first the "INSERT", then the "MODIFY", where the modification has the "OldImage" and "NewImage". Data on changes is partitioned by default inside the bucket, with the smallest partition being on the hour of the day.

### How to query the data

In the past, one of the negative sides of storing this kind of data in Amazon S3 would be losing some flexibility: typically, you would have to get (download) the files that were relevant, and then do some data analytics on it. That is no longer the case. There's a nice feature in Amazon S3 where you can query the data in files directly, using a SQL-like language. For example, to get all audit records with partitionKey equal to "1":

```
aws s3api select-object-content \
--bucket BUCKET_NAME \
--key BUCKET_KEY \
--expression "select * from s3object as s where s.dynamodb.Keys.partitionKey.S = '1'" \
--expression-type 'SQL' \
--input-serialization '{"JSON": {"Type": "LINES"}}' \
--output-serialization '{"JSON": {}}' "output.json"
```

## Conclusion

In this blog post, a simple architecture to store audit trail from an Amazon DynamoDB table was presented. The data pipeline to export this data through AWS Kinesis was detailed, and information on how to query the final data was provided. Future improvements on this pattern include data preprocessing and scaling.

All code referenced in this blog post is available in [this repository](https://github.com/luiscrs14/simple-aws-audit-trail{externalnofollow}).

An article about audit trail solution with AWS Kinesis and S3 with a focus on simplicity and affordability

Insights about technology and software outsourcing

HIPAA-Compliant Cloud Storage Services

GDPR Compliance Solutions for B2B Companies

Enterprise Business Intelligence

Simple and affordable audit trail solution with AWS Kinesis and S3