> ## Documentation Index
> Fetch the complete documentation index at: https://docs.auxia.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon Kinesis setup guide

> Connect an Amazon Kinesis data stream to Auxia step by step

Kinesis connections are provisioned by Auxia as part of onboarding. Your Auxia solutions engineer coordinates these steps with you; the AWS-side work takes about **30 minutes**.

## Prerequisites

* An Amazon Kinesis data stream carrying the events you want to send to Auxia
* Permission to register a stream consumer, and to attach **resource policies** to the stream and the consumer
* If the stream is encrypted with a customer-managed key: permission to update the **KMS key policy**
* An agreed event schema — see [Record format and schema](/data-ingestion/data-connections/amazon-kinesis#record-format-and-schema)

## Placeholders used in this guide

Replace these values in every command and policy below:

| Placeholder | Replace with |
| - | - |
| `us-east-1` | The region your stream is in |
| `111122223333` | Your AWS account ID |
| `your-stream-name` | Your Kinesis stream name |
| `auxia:1234567890` | The consumer name and suffix returned in step 2 |
| `your-kms-key-id` | Your KMS key ID, if the stream uses a customer-managed key |

The Auxia role ARN, `arn:aws:iam::838011126883:role/AuxiaTransferRole`, is **not** a placeholder. Use it as written unless your Auxia solutions engineer gives you a different ARN.

## Setup instructions

<Steps>
  <Step title="Share your stream details with Auxia">
    Send these to your Auxia solutions engineer:

    | Detail | Example |
    | - | - |
    | Stream ARN | `arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name` |
    | AWS region | `us-east-1` |
    | Shard count and expected throughput | 8 shards, about 2,000 records per second at peak |
    | KMS key ARN (only for a customer-managed key) | `arn:aws:kms:us-east-1:111122223333:key/abcd-1234` |
    | Event schema | Field names, types, and the event timestamp field |
  </Step>

  <Step title="Register an enhanced fan-out consumer">
    Register a stream consumer for Auxia. Enhanced fan-out gives Auxia its own read throughput, so its reads don't compete with your existing consumers.

    ```bash theme={null}
    aws kinesis register-stream-consumer \
      --stream-arn arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name \
      --consumer-name auxia
    ```

    Share the resulting **consumer ARN** with Auxia. It looks like:

    ```
    arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name/consumer/auxia:1234567890
    ```
  </Step>

  <Step title="Grant the Auxia role read access">
    You **don't need to create an IAM role**. Instead, grant read access to the Auxia-owned role with resource policies on the stream and on the consumer.

    Attach a resource policy to the **stream**, so Auxia can list its shards:

    ```json stream-policy.json theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowAuxiaListShards",
          "Effect": "Allow",
          "Principal": { "AWS": "arn:aws:iam::838011126883:role/AuxiaTransferRole" },
          "Action": ["kinesis:ListShards"],
          "Resource": "arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name"
        }
      ]
    }
    ```

    Attach a resource policy to the **consumer**, so Auxia can read records:

    ```json consumer-policy.json theme={null}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowAuxiaSubscribeToShard",
          "Effect": "Allow",
          "Principal": { "AWS": "arn:aws:iam::838011126883:role/AuxiaTransferRole" },
          "Action": ["kinesis:SubscribeToShard", "kinesis:DescribeStreamConsumer"],
          "Resource": "arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name/consumer/auxia:1234567890"
        }
      ]
    }
    ```

    Apply each policy — once for the stream, once for the consumer:

    ```bash theme={null}
    aws kinesis put-resource-policy \
      --resource-arn arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name \
      --policy file://stream-policy.json

    aws kinesis put-resource-policy \
      --resource-arn arn:aws:kinesis:us-east-1:111122223333:stream/your-stream-name/consumer/auxia:1234567890 \
      --policy file://consumer-policy.json
    ```
  </Step>

  <Step title="Grant decrypt access (encrypted streams only)">
    If your stream uses server-side encryption with a **customer-managed key**, add the Auxia role to the key policy. Without this, Auxia can connect to the stream but can't read records.

    ```json theme={null}
    {
      "Sid": "AllowAuxiaTransferRoleDecrypt",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::838011126883:role/AuxiaTransferRole" },
      "Action": ["kms:Decrypt", "kms:DescribeKey"],
      "Resource": "arn:aws:kms:us-east-1:111122223333:key/your-kms-key-id"
    }
    ```

    Streams encrypted with the AWS-managed Kinesis key need no extra configuration.
  </Step>

  <Step title="Auxia configures ingestion">
    Auxia creates the import topic and the destination table, then checks end to end that records land correctly. There's nothing for you to do in this step.

    <Warning>
      Don't send production traffic until Auxia confirms the schema is registered — records sent earlier are dead-lettered instead of landing.
    </Warning>
  </Step>
</Steps>

## Need help?

If you need help registering the consumer, applying resource policies, or granting KMS key permissions, contact [support@auxia.io](mailto:support@auxia.io) or your Auxia solutions engineer.

## Related articles

* [Amazon Kinesis overview](/data-ingestion/data-connections/amazon-kinesis)
* [What data is needed](/data-ingestion/what-data-is-needed)
* [How ingestion works](/data-ingestion/concepts/how-ingestion-works)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.