---
schema_version: "1"
id: 4f469d6f233c8736fd80c551c561506302606d71a4360a5bf5dd332292840ee2
title: Set Up an Amazon Kinesis Target Connection
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_set_up_an_amazon_kinesis_target_connection.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_set_up_an_amazon_kinesis_target_connection.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 72464c871467705cc6b0bba50a68cea66ec048cbbe1a307373aff82a8dd36089
description: Send data action events from Data 360 to an Amazon Kinesis data stream. Use an access key or Salesforce as an OpenID Connect identity provider.
products:
- Data 360
release: "264"
---
# Set Up an Amazon Kinesis Target Connection
Send data action events from Data 360 to an Amazon Kinesis data stream. Use an access key or Salesforce as an OpenID Connect identity provider.
### Required Editions
Before you begin, review [VPC Interface Endpoints for Amazon Kinesis Connection](https://help.salesforce.com/s/articleView?id=data.c360_a_kinesis_vpc_endpoints.htm&release=264.0.0&type=5 "Data Cloud uses the VPC Endpoints listed here to communicate with Amazon Kinesis. If your security policy requires a strict network ACL (access control list), make sure to include these endpoints to your allowlists.") so the connection has the required network access.
Key-based authentication uses an IAM user's access key and secret. Identity-provider authentication configures Salesforce as an OpenID Connect identity provider in AWS and uses an IAM role.
1. In Data 360, click **Setup**, and select **Data Cloud Setup**.
2. Under External Integrations, select **Other Connectors**, and click **New**.
3. On the Target tab, select **Amazon Kinesis**, and click **Next**.
4. Enter a connection name and a connection API name.
5. Select an authentication method.
- To use key-based authentication, click **Access Key/Secret Based** and enter the information for the IAM user that connects to the Kinesis data stream. Then continue with the stream settings.
- To use identity-provider authentication, click **Identity Provider Based**, and complete the AWS identity provider and role setup in the next step.
6. If you clicked **Identity Provider Based**, add Salesforce as an identity provider in AWS IAM.
1. In the AWS IAM dashboard, select **Identity providers**, and click **Add provider**.
2. Enter the provider details, and click **Add provider**.
| Item | What to Enter | Example |
| --- | --- | --- |
| Provider type | OpenID Connect | None |
| Provider URL | My Domain URL with `/services/connectors` appended | https://yourcompany.my.salesforce.com/services/connectors |
| Audience | My Domain URL | https://yourcompany.my.salesforce.com |
3. Create an IAM role that provides access to the Kinesis data stream.
For Trusted Entity Type, select **Web identity**. Select the provider and audience that you created.
Add this JSON permission policy for the role.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDataCloudKinesisEgressConnectionTestAndPublish",
"Effect": "Allow",
"Action": [
"kinesis:DescribeStreamSummary",
"kinesis:PutRecord",
"kinesis:PutRecords"
],
"Resource": "arn:aws:kinesis:::stream/"
}
]
}
```
If the stream uses a customer-managed KMS key, include this additional statement.
```
{
"Sid": "AllowKmsForEncryptedKinesisWrites",
"Effect": "Allow",
"Action": [
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:::key/"
}
```
4. Enter a name for the role, and click **Create role**.
5. From Data 360, copy the External ID.
6. On the IAM role page, on the Trust relationships tab, click **Edit trust policy**.
7. In the trust policy, replace the external ID placeholder with the Data 360 External ID.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam:::oidc-provider//services/connectors"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"/services/connectors:aud": "https://",
"/services/connectors:sub": ""
}
}
}
]
}
```
8. From AWS IAM, copy the role's Amazon Resource Name (ARN).
9. In Data 360, enter the ARN in the IAM Role Name field.
7. Enter the Kinesis data stream's name.
8. Enter the name of the AWS region where the Kinesis data stream is hosted.
9. Enter the Kinesis data stream's endpoint. See [Amazon Kinesis endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/ak.html).
10. To review your configuration, click **Test Connection**.
11. When the connection succeeds, click **Save**.
The connection is created and listed under More Connectors. A Data Aware Specialist can create data streams that use this connection.
Note Create only one connection for each Kinesis data stream. A stream is identified by its name and region.