Docs / Strand / connectors/aws-kinesis
AWS Kinesis Connector
Stream real-time data into and out of Amazon Kinesis Data Streams from your Strand workflows.
Prerequisites
You need AWS credentials with Kinesis permissions. Here's how to set them up:
- Sign in to the AWS Management Console and navigate to IAM
- Create a new IAM user or use an existing one
- Attach a policy with the permissions listed in Required Permissions below
- Under Security credentials, create an Access key
- Copy the Access Key ID and Secret Access Key
Required Permissions
The IAM user or role must have the following permissions:
| Operation | Required IAM Permissions |
|---|---|
| Put Record | kinesis:PutRecord |
| Get Records | kinesis:GetShardIterator, kinesis:GetRecords, kinesis:DescribeStream, kinesis:ListShards |
Tip: Scope permissions to specific stream ARNs. Use a dedicated IAM user with only the permissions your workflows need.
Connector Setup
Create an AWS Kinesis connector from the Connectors page.
Configuration Fields
| Field | Required | Description |
|---|---|---|
| Name | Yes | Friendly name (e.g., "Production Kinesis") |
| Authentication Type | No | api_key (default) for explicit credentials, role to use the host's IAM role / default credential chain |
| Region | Yes | AWS region where your Kinesis streams reside (e.g., us-east-1) |
| Endpoint URL | No | Custom endpoint for a self-managed target or an AWS VPC endpoint. Leave empty for AWS. |
| Access Key ID | Conditional | IAM user access key ID (encrypted at rest). Required when Authentication Type is api_key |
| Secret Access Key | Conditional | IAM user secret access key (encrypted at rest). Required when Authentication Type is api_key |
| Role ARN | Conditional | Your IAM role ARN for cross-account access via STS AssumeRole. Required when Authentication Type is role. The role must trust the Tendrl AWS account. |
| External ID | No | External ID for STS AssumeRole (encrypted). Recommended with role auth to prevent confused-deputy attacks. |
| Timeout | No | API request timeout in seconds (default: 30) |
| Description | No | Optional description for reference |
With role authentication you do not store static access keys; Strand authenticates using the host's default credential chain (EC2 instance profile, ECS task role, or environment credentials). You must still provide a Role ARN when creating the connector (the role should trust the Tendrl AWS account); an optional External ID hardens the trust policy.
Operations
Put Record
Write a single data record to a Kinesis stream.
The record payload is the incoming event payload (serialized to JSON). There is no separate Data field; shape the payload with an upstream node if needed.
| Field | Required | Description |
|---|---|---|
| Stream Name | No | Name of the Kinesis data stream (e.g., order-events). Leave empty to use the connector default. |
| Partition Key | No | Determines which shard the record is routed to (e.g., {{ payload.user_id }}). Defaults to a generated UUID if not specified. |
Example: the event payload sent as the record
{
"event": "order_placed",
"order_id": "ORD-001",
"customer": "Alice",
"total": 149.99,
"timestamp": "2026-02-18T14:30:00Z"
}
Get Records
Read records from a specific shard in a Kinesis stream.
| Field | Required | Description |
|---|---|---|
| Stream Name | No | Name of the Kinesis data stream. Leave empty to use the connector default. |
| Shard ID | Yes | The shard to read from (e.g., shardId-000000000000) |
| Shard Iterator Type | No | Iterator type: TRIM_HORIZON (beginning), LATEST, or AT_TIMESTAMP (default: TRIM_HORIZON) |
| Timestamp | Conditional | ISO 8601 timestamp to start reading from. Required when Shard Iterator Type is AT_TIMESTAMP. |
| Limit | No | Maximum number of records to return (default: 10) |
Example: Read records from a shard
- Stream Name:
order-events - Shard ID:
shardId-000000000000 - Limit:
50
Output
Put Record Output
{
"success": true,
"status": "sent",
"data": {
"stream": "order-events",
"shard_id": "shardId-000000000001",
"sequence_number": "49607689048506540625859353263605505338738884163461496834"
},
"service": "aws.kinesis",
"operation": "put_record"
}
Key fields for subsequent nodes:
{{ steps.node_a1b2c3d4.output_payload.data.shard_id }}: Shard the record was written to{{ steps.node_a1b2c3d4.output_payload.data.sequence_number }}: Unique sequence number for the record
Get Records Output
Each record is decoded from its JSON payload back into an object (records that aren't valid JSON are returned as {"raw": "..."}). status is received when records are returned, or empty otherwise.
{
"success": true,
"status": "received",
"data": {
"stream": "order-events",
"shard_id": "shardId-000000000000",
"records": [
{"event": "order_placed", "order_id": "ORD-001"}
],
"count": 1
},
"service": "aws.kinesis",
"operation": "get_records"
}
Key fields for subsequent nodes:
{{ steps.node_a1b2c3d4.output_payload.data.records }}: Array of decoded records{{ steps.node_a1b2c3d4.output_payload.data.count }}: Number of records returned
Errors
| Error | Meaning |
|---|---|
| AWS access_key_id is required | Access key ID not configured in connector. |
| AWS secret_access_key is required | Secret access key not configured in connector. |
| ResourceNotFoundException | The specified stream does not exist in the configured region. |
| InvalidArgumentException | A parameter value is invalid (e.g., bad shard ID or iterator type). |
| ProvisionedThroughputExceededException | Read or write throughput limit exceeded. Retry with backoff or increase shard count. |
| ExpiredIteratorException | The shard iterator has expired (they last 5 minutes). Re-fetch the iterator. |
| AccessDeniedException | The IAM user lacks the required Kinesis permissions. |
| UnrecognizedClientException | Invalid AWS access key ID. |
| SignatureDoesNotMatch | Secret access key is incorrect. |
Example Workflow
- Create Connector with your AWS credentials and region
us-east-1(or useauth_type: "role"to leverage the host's IAM role) - Put record when an order event arrives (the event payload is sent as the record):
- Stream Name:
order-events - Partition Key:
{{ payload.customer_id }}(optional; defaults to a generated UUID)
- Log confirmation to a downstream node:
- Reference:
{{ steps.put_order.output_payload.data.sequence_number }}
Limitations
- Single record writes: Each Put Record operation writes one record. For batch writes, use multiple workflow nodes or a loop.
- Shard management: Shard splitting and merging must be managed through the AWS Console or CLI.
- Record size: Individual records are limited to 1 MB by AWS.
- Data retention: Kinesis retains data for 24 hours by default (up to 365 hours with extended retention enabled in AWS).
- Consumer tracking: Checkpoint management for consumers is not handled automatically. Use sequence numbers from output to track position.
Tendrl