View a markdown version of this page

Access control for streaming tables and Amazon S3 delivery - Amazon Kinesis Data Streams

Access control for streaming tables and Amazon S3 delivery

Streaming tables and Amazon S3 delivery use an IAM service execution role that Amazon Kinesis Data Streams assumes to write data to your destination. Follow these access control practices:

  • Least privilege – Grant only the minimum permissions the service execution role needs. Scope Amazon S3 permissions to specific buckets and prefixes rather than using wildcards.

  • Scope to specific resources – Restrict permissions to the specific bucket, table bucket, or table that the delivery writes to. Avoid using Resource: "*".

  • Confused deputy prevention – Include aws:SourceArn and aws:SourceAccount conditions in the service execution role trust policy so that only your delivery resources can assume the role.

  • Source stream encryption – If your stream is encrypted with an AWS managed key (the aws/kinesis alias), you cannot create a delivery. Use a customer managed key for stream encryption instead.

For the complete service execution role policies, see IAM permissions for data delivery. For encryption details and audit logging, see Security for data delivery.