The policy for a data stream or registered consumer.

Policies define the operations that are allowed on this resource.

You almost never need to define this construct directly.

All AWS resources that support resource policies have a method called
`addToResourcePolicy()`, which will automatically create a new resource
policy if one doesn't exist yet, otherwise it will add to the existing
policy.

Prefer to use `addToResourcePolicy()` instead.

ResourcePolicy

IAM policy document to apply to a data stream.

policyDocument

The stream this policy applies to.

Note: only one of `stream` and `streamConsumer` must be set.

stream

The stream consumer this policy applies to.

Note: only one of `stream` and `streamConsumer` must be set.

streamConsumer

A Kinesis stream.

Can be encrypted with a KMS key.

Adds a statement to the IAM resource policy associated with this stream.

If this stream was created in this stack (`new Stream`), a resource policy
will be automatically created upon the first call to `addToResourcePolicy`. If
the stream is imported (`Stream.import`), then this is a no-op.

addToResourcePolicy

Grant the indicated permissions on this stream to the given IAM principal (Role/Group/User).

[disable-awslint:no-grants]

grant

Grant read permissions for this stream and its contents to an IAM principal (Role/Group/User).

If an encryption key is used, permission to ues the key to decrypt the
contents of the stream will also be granted.

[disable-awslint:no-grants]

grantRead

Grants read/write permissions for this stream and its contents to an IAM principal (Role/Group/User).

If an encryption key is used, permission to use the key for
encrypt/decrypt will also be granted.

[disable-awslint:no-grants]

grantReadWrite

Grant write permissions for this stream and its contents to an IAM principal (Role/Group/User).

If an encryption key is used, permission to ues the key to encrypt the
contents of the stream will also be granted.

[disable-awslint:no-grants]

grantWrite

Return stream metric based from its metric name.

metric

The number of records retrieved from the shard, measured over the specified time period.

Minimum, Maximum, and
Average statistics represent the records in a single GetRecords operation for the stream in the specified time
period.

average
The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricGetRecords

The number of bytes retrieved from the Kinesis stream, measured over the specified time period.

Minimum, Maximum,
and Average statistics represent the bytes in a single GetRecords operation for the stream in the specified time
period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricGetRecordsBytes

The age of the last record in all GetRecords calls made against a Kinesis stream, measured over the specified time period.

Age is the difference between the current time and when the last record of the GetRecords call was written
to the stream. The Minimum and Maximum statistics can be used to track the progress of Kinesis consumer
applications. A value of zero indicates that the records being read are completely caught up with the stream.

The metric defaults to maximum over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricGetRecordsIteratorAgeMilliseconds

The number of successful GetRecords operations per stream, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricGetRecordsLatency

metricGetRecordsSuccess

The number of bytes successfully put to the Kinesis stream over the specified time period.

This metric includes
bytes from PutRecord and PutRecords operations. Minimum, Maximum, and Average statistics represent the bytes in a
single put operation for the stream in the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricIncomingBytes

The number of records successfully put to the Kinesis stream over the specified time period.

This metric includes
record counts from PutRecord and PutRecords operations. Minimum, Maximum, and Average statistics represent the
records in a single put operation for the stream in the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricIncomingRecords

The number of bytes put to the Kinesis stream using the PutRecord operation over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordBytes

The time taken per PutRecord operation, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordLatency

The number of bytes put to the Kinesis stream using the PutRecords operation over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsBytes

The number of records rejected due to internal failures in a PutRecords operation per Kinesis data stream, measured over the specified time period.

Occasional internal failures are to be expected and should be retried.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsFailedRecords

The time taken per PutRecords operation, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsLatency

The number of PutRecords operations where at least one record succeeded, per Kinesis stream, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsSuccess

The number of successful records in a PutRecords operation per Kinesis data stream, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsSuccessfulRecords

The number of records rejected due to throttling in a PutRecords operation per Kinesis data stream, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsThrottledRecords

The total number of records sent in a PutRecords operation per Kinesis data stream, measured over the specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordsTotalRecords

The number of successful PutRecord operations per Kinesis stream, measured over the specified time period.

Average
reflects the percentage of successful writes to a stream.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricPutRecordSuccess

The number of GetRecords calls throttled for the stream over the specified time period.

The most commonly used
statistic for this metric is Average.

When the Minimum statistic has a value of 1, all records were throttled for the stream during the specified time
period.

When the Maximum statistic has a value of 0 (zero), no records were throttled for the stream during the specified
time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties

metricReadProvisionedThroughputExceeded

The number of records rejected due to throttling for the stream over the specified time period.

This metric
includes throttling from PutRecord and PutRecords operations.

When the Minimum statistic has a non-zero value, records were being throttled for the stream during the specified
time period.

When the Maximum statistic has a value of 0 (zero), no records were being throttled for the stream during the
specified time period.

The metric defaults to average over 5 minutes, it can be changed by passing `statistic` and `period` properties.

metricWriteProvisionedThroughputExceeded

Stream

The kind of server-side encryption to apply to this stream.

If you choose KMS, you can specify a KMS key via `encryptionKey`. If
encryption key is not specified, a key will automatically be created.

encryption

External KMS key to use for stream encryption.

The 'encryption' property must be set to "Kms".

encryptionKey

Policy to apply when the stream is removed from the stack.

removalPolicy

The number of hours for the data records that are stored in shards to remain accessible.

retentionPeriod

The number of shards for the stream.

Can only be provided if streamMode is Provisioned.

shardCount

A list of shard-level metrics in properties to enable enhanced monitoring mode.

shardLevelMetrics

streamMode

Enforces a particular physical stream name.

streamName

Adds a statement to the IAM resource policy associated with this stream consumer.

If this stream consumer was created in this stack (`new StreamConsumer`), a resource policy
will be automatically created upon the first call to `addToResourcePolicy`. If
the stream is imported (`StreamConsumer.from`), then this is a no-op.

Grant the indicated permissions on this stream consumer to the given IAM principal (Role/Group/User).

[disable-awslint:no-grants]

Grant read permissions for this stream consumer and its associated stream to an IAM principal (Role/Group/User).

[disable-awslint:no-grants]

StreamConsumer

The Kinesis data stream to associate this consumer with.

streamConsumerName

Attaches a resource-based policy to a data stream or registered consumer.

If you are using an identity other than the root user of the AWS account that owns the resource, the calling identity must have the `PutResourcePolicy` permissions on the specified Kinesis Data Streams resource and belong to the owner's account in order to use this operation. If you don't have `PutResourcePolicy` permissions, Amazon Kinesis Data Streams returns a `403 Access Denied error` . If you receive a `ResourceNotFoundException` , check to see if you passed a valid stream or consumer resource.

Request patterns can be one of the following:

- Data stream pattern: `arn:aws.*:kinesis:.*:\d{12}:.*stream/\S+`
- Consumer pattern: `^(arn):aws.*:kinesis:.*:\d{12}:.*stream\/[a-zA-Z0-9_.-]+\/consumer\/[a-zA-Z0-9_.-]+:[0-9]+`

For more information, see [Controlling Access to Amazon Kinesis Data Streams Resources Using IAM](https://docs.aws.amazon.com/streams/latest/dev/controlling-access.html) .

CfnResourcePolicy

Returns the Amazon Resource Name (ARN) of the resource-based policy.

resourceArn

This is the description for the resource policy.

resourcePolicy

Creates a Kinesis stream that captures and transports data records that are emitted from data sources.

For information about creating streams, see [CreateStream](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_CreateStream.html) in the Amazon Kinesis API Reference.

CfnStream

desiredShardLevelMetrics

The maximum record size of a single record in kibibyte (KiB) that you can write to, and read from a stream.

maxRecordSizeInKiB

The name of the Kinesis stream.

If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the stream name. For more information, see [Name Type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) .

If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.

name

The number of hours for the data records that are stored in shards to remain accessible.

The default value is 24. For more information about the stream retention period, see [Changing the Data Retention Period](https://docs.aws.amazon.com/streams/latest/dev/kinesis-extended-retention.html) in the Amazon Kinesis Developer Guide.

retentionPeriodHours

The number of shards that the stream uses.

For greater provisioned throughput, increase the number of shards.

When specified, enables or updates server-side encryption using an AWS KMS key for a specified stream.

Removing this property from your stack template and updating your stack disables encryption.

streamEncryption

Specifies the capacity mode to which you want to set your data stream.

Currently, in Kinesis Data Streams, you can choose between an *on-demand* capacity mode and a *provisioned* capacity mode for your data streams.

streamModeDetails

An arbitrary set of tags (key–value pairs) to associate with the Kinesis stream.

For information about constraints for this property, see [Tag Restrictions](https://docs.aws.amazon.com/streams/latest/dev/tagging.html#tagging-restrictions) in the *Amazon Kinesis Developer Guide* .

warmThroughputMiBps

Use the AWS CloudFormation `AWS::Kinesis::StreamConsumer` resource to register a consumer with a Kinesis data stream.

The consumer you register can then call [SubscribeToShard](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_SubscribeToShard.html) to receive data from the stream using enhanced fan-out, at a rate of up to 2 MiB per second for every shard you subscribe to. This rate is unaffected by the total number of consumers that read from the same stream.

You can register up to 20 consumers per stream. However, you can request a limit increase using the [Kinesis Data Streams limits form](https://docs.aws.amazon.com/support/v1?#/) . A given consumer can only be registered with one stream at a time.

For more information, see [Using Consumers with Enhanced Fan-Out](https://docs.aws.amazon.com/streams/latest/dev/introduction-to-enhanced-consumers.html) .

CfnStreamConsumer

The name of the consumer is something you choose when you register the consumer.

consumerName

The ARN of the stream with which you registered the consumer.

streamArn

An array of tags to be added to a specified Kinesis resource.

A tag consists of a required key and an optional value. You can specify up to 50 tag key-value pairs.

Amazon Kinesis

L2 Constructs3

ResourcePolicy

Stream

StreamConsumer

L1 Constructs3

CfnResourcePolicy

CfnStream

CfnStreamConsumer

Learn AWS the Practical Way

Quick Facts

Related Links