Producers send PII records to an Amazon Kinesis Data Streams stream that is consumed by a Lambda function. Compliance requires the records to be encrypted at rest within the stream. What is the simplest way to achieve this?

Pick an option to reveal the answer.