You can also add encryption to the stream by using the AWS Key Management Service (KMS). 

If you exceed the limits when calling the GetShardIterator requests, it will throw a ProvisionedThroughputExceededException. For KDS limits, refer to the service-sizes-and-limits documentation reference link limits in the See also section.