Salesforce Docs Portal

Set Up an Amazon Kinesis Target Connection

Send data action events from Data 360 to an Amazon Kinesis data stream. Use an access key or Salesforce as an OpenID Connect identity provider.

Required Editions

Available in: All Editions supported by Data 360. See Data 360 edition availability.
User Permissions Needed
To create an Amazon Kinesis connection:

System Admin profile OR

Data Cloud Architect permission set

Before you begin, review VPC Interface Endpoints for Amazon Kinesis Connection so the connection has the required network access.

Key-based authentication uses an IAM user's access key and secret. Identity-provider authentication configures Salesforce as an OpenID Connect identity provider in AWS and uses an IAM role.

  1. In Data 360, click Setup, and select Data Cloud Setup.
  2. Under External Integrations, select Other Connectors, and click New.
  3. On the Target tab, select Amazon Kinesis, and click Next.
  4. Enter a connection name and a connection API name.
  5. Select an authentication method.
    • To use key-based authentication, click Access Key/Secret Based and enter the information for the IAM user that connects to the Kinesis data stream. Then continue with the stream settings.
    • To use identity-provider authentication, click Identity Provider Based, and complete the AWS identity provider and role setup in the next step.
  6. If you clicked Identity Provider Based, add Salesforce as an identity provider in AWS IAM.
    1. In the AWS IAM dashboard, select Identity providers, and click Add provider.
    2. Enter the provider details, and click Add provider.
      Item What to Enter Example
      Provider type OpenID Connect None
      Provider URL My Domain URL with /services/connectors appended https://yourcompany.my.salesforce.com/services/connectors
      Audience My Domain URL https://yourcompany.my.salesforce.com
    3. Create an IAM role that provides access to the Kinesis data stream.

      For Trusted Entity Type, select Web identity. Select the provider and audience that you created.

      Add this JSON permission policy for the role.

      {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDataCloudKinesisEgressConnectionTestAndPublish",
      "Effect": "Allow",
      "Action": [
        "kinesis:DescribeStreamSummary",
        "kinesis:PutRecord",
        "kinesis:PutRecords"
      ],
      "Resource": "arn:aws:kinesis:<region>:<account-id>:stream/<kinesis-stream-name>"
    }
  ]
}

      If the stream uses a customer-managed KMS key, include this additional statement.

      {
  "Sid": "AllowKmsForEncryptedKinesisWrites",
  "Effect": "Allow",
  "Action": [
    "kms:GenerateDataKey"
  ],
  "Resource": "arn:aws:kms:<region>:<account-id>:key/<key-id>"
}
    4. Enter a name for the role, and click Create role.
    5. From Data 360, copy the External ID.
    6. On the IAM role page, on the Trust relationships tab, click Edit trust policy.
    7. In the trust policy, replace the external ID placeholder with the Data 360 External ID. 
      {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:oidc-provider/<YOUR_SALESFORCE_DOMAIN>/services/connectors"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<YOUR_SALESFORCE_DOMAIN>/services/connectors:aud": "https://<YOUR_SALESFORCE_DOMAIN>",
          "<YOUR_SALESFORCE_DOMAIN>/services/connectors:sub": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}
    8. From AWS IAM, copy the role's Amazon Resource Name (ARN).
    9. In Data 360, enter the ARN in the IAM Role Name field.
  7. Enter the Kinesis data stream's name.
  8. Enter the name of the AWS region where the Kinesis data stream is hosted.
  9. Enter the Kinesis data stream's endpoint. See Amazon Kinesis endpoints and quotas.
  10. To review your configuration, click Test Connection.
  11. When the connection succeeds, click Save.

The connection is created and listed under More Connectors. A Data Aware Specialist can create data streams that use this connection.

Note
Note Create only one connection for each Kinesis data stream. A stream is identified by its name and region.