Docs / Strand / connectors/aws-kinesis

AWS Kinesis Connector

Stream real-time data into and out of Amazon Kinesis Data Streams from your Strand workflows.

Prerequisites

You need AWS credentials with Kinesis permissions. Here's how to set them up:

  1. Sign in to the AWS Management Console and navigate to IAM
  2. Create a new IAM user or use an existing one
  3. Attach a policy with the permissions listed in Required Permissions below
  4. Under Security credentials, create an Access key
  5. Copy the Access Key ID and Secret Access Key

Required Permissions

The IAM user or role must have the following permissions:

Operation Required IAM Permissions
Put Record kinesis:PutRecord
Get Records kinesis:GetShardIterator, kinesis:GetRecords, kinesis:DescribeStream, kinesis:ListShards
Tip: Scope permissions to specific stream ARNs. Use a dedicated IAM user with only the permissions your workflows need.

Connector Setup

Create an AWS Kinesis connector from the Connectors page.

Configuration Fields

Field Required Description
Name Yes Friendly name (e.g., "Production Kinesis")
Authentication Type No api_key (default) for explicit credentials, role to use the host's IAM role / default credential chain
Region Yes AWS region where your Kinesis streams reside (e.g., us-east-1)
Endpoint URL No Custom endpoint for a self-managed target or an AWS VPC endpoint. Leave empty for AWS.
Access Key ID Conditional IAM user access key ID (encrypted at rest). Required when Authentication Type is api_key
Secret Access Key Conditional IAM user secret access key (encrypted at rest). Required when Authentication Type is api_key
Role ARN Conditional Your IAM role ARN for cross-account access via STS AssumeRole. Required when Authentication Type is role. The role must trust the Tendrl AWS account.
External ID No External ID for STS AssumeRole (encrypted). Recommended with role auth to prevent confused-deputy attacks.
Timeout No API request timeout in seconds (default: 30)
Description No Optional description for reference
Role-Based Authentication

With role authentication you do not store static access keys; Strand authenticates using the host's default credential chain (EC2 instance profile, ECS task role, or environment credentials). You must still provide a Role ARN when creating the connector (the role should trust the Tendrl AWS account); an optional External ID hardens the trust policy.

Operations

Put Record

Write a single data record to a Kinesis stream.

The record payload is the incoming event payload (serialized to JSON). There is no separate Data field; shape the payload with an upstream node if needed.

Field Required Description
Stream Name No Name of the Kinesis data stream (e.g., order-events). Leave empty to use the connector default.
Partition Key No Determines which shard the record is routed to (e.g., {{ payload.user_id }}). Defaults to a generated UUID if not specified.

Example: the event payload sent as the record

json

{
  "event": "order_placed",
  "order_id": "ORD-001",
  "customer": "Alice",
  "total": 149.99,
  "timestamp": "2026-02-18T14:30:00Z"
}

Get Records

Read records from a specific shard in a Kinesis stream.

Field Required Description
Stream Name No Name of the Kinesis data stream. Leave empty to use the connector default.
Shard ID Yes The shard to read from (e.g., shardId-000000000000)
Shard Iterator Type No Iterator type: TRIM_HORIZON (beginning), LATEST, or AT_TIMESTAMP (default: TRIM_HORIZON)
Timestamp Conditional ISO 8601 timestamp to start reading from. Required when Shard Iterator Type is AT_TIMESTAMP.
Limit No Maximum number of records to return (default: 10)

Example: Read records from a shard

Output

Put Record Output

json

{
  "success": true,
  "status": "sent",
  "data": {
    "stream": "order-events",
    "shard_id": "shardId-000000000001",
    "sequence_number": "49607689048506540625859353263605505338738884163461496834"
  },
  "service": "aws.kinesis",
  "operation": "put_record"
}

Key fields for subsequent nodes:

Get Records Output

Each record is decoded from its JSON payload back into an object (records that aren't valid JSON are returned as {"raw": "..."}). status is received when records are returned, or empty otherwise.

json

{
  "success": true,
  "status": "received",
  "data": {
    "stream": "order-events",
    "shard_id": "shardId-000000000000",
    "records": [
      {"event": "order_placed", "order_id": "ORD-001"}
    ],
    "count": 1
  },
  "service": "aws.kinesis",
  "operation": "get_records"
}

Key fields for subsequent nodes:

Errors

Error Meaning
AWS access_key_id is required Access key ID not configured in connector.
AWS secret_access_key is required Secret access key not configured in connector.
ResourceNotFoundException The specified stream does not exist in the configured region.
InvalidArgumentException A parameter value is invalid (e.g., bad shard ID or iterator type).
ProvisionedThroughputExceededException Read or write throughput limit exceeded. Retry with backoff or increase shard count.
ExpiredIteratorException The shard iterator has expired (they last 5 minutes). Re-fetch the iterator.
AccessDeniedException The IAM user lacks the required Kinesis permissions.
UnrecognizedClientException Invalid AWS access key ID.
SignatureDoesNotMatch Secret access key is incorrect.

Example Workflow

  1. Create Connector with your AWS credentials and region us-east-1 (or use auth_type: "role" to leverage the host's IAM role)
  2. Put record when an order event arrives (the event payload is sent as the record):
  1. Log confirmation to a downstream node:

Limitations