AWS Kinesis Firehose Hybrid Runner

• Requirements
• Metadata Ingestion
• Troubleshooting

​

Requirements

• AWS Credentials: Valid AWS credentials (Access Key ID and Secret Access Key) or IAM role with permissions to access Kinesis Firehose
• Permissions Required:
  • firehose:DescribeDeliveryStream - To describe delivery stream details
  • firehose:ListDeliveryStreams - To list all delivery streams
  • dynamodb:describe_kinesis_streaming_destination- To describe dynamodb table destination kinesis stream

​

Metadata Ingestion

​

Step 1: Add New Service

1. In the left navigation, click Connections.
2. On the Connections page, click Add New Service.

​

Step 2: Select a Service and Connector

​

Step 3: Add Service Name and Description

• Enter a unique, descriptive Service Name. Collate identifies services by their service name. Enter a name that distinguishes this deployment from other AWS Kinesis Firehose services you are ingesting metadata from.
• Optional: Enter a Description for the service.

​

Step 4: Configure Connection Options

​

Select Ingestion Runner

​

Enter Connection Details

• AWS Access Key ID: AWS Access Key ID is a unique identifier for your AWS account. It is used in combination with the Secret Access Key to authenticate API requests to AWS services. This is an optional field if you are using IAM roles or AWS profiles for authentication.
• AWS Secret Access Key: AWS Secret Access Key is a secret key that is used in combination with the Access Key ID to cryptographically sign API requests to AWS services. Keep this value secure and never share it. This is an optional field if you are using IAM roles or AWS profiles for authentication.
• AWS Region: AWS Region where your Kinesis Firehose delivery streams are deployed. This is a required field. Examples include:
  • us-east-1 (US East - N. Virginia)
  • us-west-2 (US West - Oregon)
  • eu-west-1 (Europe - Ireland)
  • ap-southeast-1 (Asia Pacific - Singapore)
  You can find the full list of AWS regions in the AWS documentation.
• AWS Session Token: AWS Session Token is a temporary credential that is required when using temporary security credentials (such as those from AWS STS). This is typically used in scenarios involving:
  • Federated user access
  • Cross-account access
  • Temporary credentials from AWS STS AssumeRole operations
  This field is optional and only needed when using temporary credentials.
• Endpoint URL: Custom endpoint URL for AWS services. This is useful when:
  • Connecting to AWS services through a VPC endpoint
  • Using AWS compatible services (like MinIO for S3-compatible storage)
  • Connecting to AWS GovCloud or other specialized AWS regions
  Leave this field empty to use the default AWS endpoints. Example format: https://firehose.us-east-1.amazonaws.com
• Profile Name: The name of an AWS profile configured in your AWS credentials file (~/.aws/credentials). When specified, the connector will use the credentials associated with this profile. This is useful when you have multiple AWS accounts or different permission sets configured locally. Example profile names:
  • default
  • production
  • development
• Assume Role ARN: The Amazon Resource Name (ARN) of an IAM role to assume for accessing Kinesis Firehose resources. This is useful for cross-account access scenarios where the Kinesis Firehose delivery streams exist in a different AWS account. Format: arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME Example: arn:aws:iam::123456789012:role/KinesisFirehoseReadOnlyRole When using Assume Role, ensure that:
  1. The role has a trust relationship with the account making the request
  2. The role has necessary permissions to access Kinesis Firehose
• Assume Role Session Name: A unique identifier for the assumed role session. This helps to distinguish between different sessions when the same role is assumed by different users or services. AWS uses this value in CloudTrail logs to help with auditing. Default value: OpenMetadataSession You can customize this to include information like:
  • Username or service name
  • Environment (dev, staging, prod)
  • Timestamp or unique identifier
• Assume Role Source Identity: The source identity to associate with the assumed role session. This is an optional field that provides additional context about who or what is assuming the role. The source identity information appears in AWS CloudTrail logs and can be useful for auditing and compliance purposes. Example: openmetadata-ingestion-service
• Messaging Service Name: The Name of the ingested Kafka Messaging Service associated with this Firehose Pipeline Service upstream source. Example: local_kafka
• Pipeline Filter Pattern: A regular expression pattern to filter which Kinesis Firehose delivery streams to include or exclude during metadata extraction. This helps you control which pipelines are ingested into Collate. Include Filter Examples:
  • .*prod.* - Include only delivery streams with “prod” in the name
  • ^analytics-.* - Include only delivery streams starting with “analytics-”
  • .*-data-stream$ - Include only delivery streams ending with “-data-stream”
  Exclude Filter Examples:
  • .*test.* - Exclude delivery streams with “test” in the name
  • ^temp-.* - Exclude delivery streams starting with “temp-”
  Leave empty to include all delivery streams.

password: secret:/my/database/password

​

Test Connection

​

Step 5: Configure Ingestion Options

​

How Filter Patterns Work

• Include: Add one or more comma-separated regular expressions. Collate ingests only assets whose names match at least one expression. Leave blank to include all assets.
• Exclude: Add one or more comma-separated regular expressions. Collate skips any asset whose name matches an expression. Leave blank to exclude nothing.

• contains: matches any name containing the value. For example, sales matches my_sales_data and sales_2024.
• starts with: matches names beginning with the value. For example, prod_ matches prod_db and prod_schema.
• ends with: matches names ending with the value. For example, _raw matches events_raw and logs_raw.
• is exactly: matches the exact name only. For example, analytics matches only analytics.
• matches regex: matches names using a regular expression. For example, ^prod_.*_v\d+$ matches prod_events_v1.

• Pipeline: Controls which pipelines (DAGs, jobs, or workflows) Collate ingests from the source.

• Scan Mode: You can choose between the following scan modes:
  • Scan all: Ingests every asset of that type the connector can access. This is the default.
  • Only specific: Enables include rules so only assets matching at least one rule are ingested.
• Exclude system toggle: Use this toggle to automatically filter out system-reserved names defined by the connector — for example, Exclude system databases for the Databases section.
• Always exclude: Add permanent exclusion rules (shown in red). Assets matching these rules are never ingested, regardless of include rules.
• Preview: Shows a real-time summary of what will be in scope based on your current rules.
• Include rules (available only in Only specific mode): Click + Add to define a rule. Added rules appear as chips; an asset is included if it matches any rule.

​

Step 6: Create & Deploy

​

Configure Metadata Agent and Schedule Ingestion

1. In the left navigation, click Connections and select your service.
2. Click the Agents tab.
3. Click Add Agent and select Metadata from the dropdown. For some services, the dropdown is not available and clicking Add Agent takes you directly to the agent configuration page.
4. On the Configure Ingestion page, do the following and click Next.
   • Name this Ingestion: Enter a unique recognizable name for this ingestion pipeline.
   • Agent Setup: Configure the core parameters for this agent. The following fields are available:

     Field	Default	Description
     Ownership Update Mode	replace	Set how owners from source metadata update Pipeline owners. In replace mode, resolved owners from the current source replace existing owners. In append mode, resolved owners are appended to active existing Pipeline owners.
     Db Service Names	—	List of database service names used for lineage resolution.
     Storage Service Names	—	List of storage service names used for lineage resolution.
     Messaging Service Names	—	List of messaging service names used for lineage resolution.
     Status Lookback Days	1	Number of days of pipeline run status history to ingest. Only runs within the last N days will be fetched.
     Include Lineage	On	Turn off to stop fetching lineage from pipelines.
     Mark Deleted Pipeline	On	Soft-delete pipelines in Collate when they are removed from the source. Associated entities like lineage are also deleted.
     Include UnDeployed Pipelines	On	Toggle whether un-deployed pipelines should be ingested. If set to false, only deployed pipelines will be ingested.

     
   • Filter Patterns: Apply include or exclude rules to scope which pipelines this agent ingests. These follow the same filter options described in Step 5.
   • Scope & Behaviour: Control what metadata to include and how to handle deletions. Toggle each option on or off based on your needs:

     Toggle	Default	Description
     Enable Debug Log	Off	Sets the ingestion log level to DEBUG. Useful for troubleshooting.
     Override Metadata	Off	When on, source values overwrite existing descriptions, tags, owners, and display names in Collate. When off, Collate only updates fields that have no existing value.
     Override Lineage	Off	When on, existing lineage is replaced with newly extracted lineage on each run.

     
5. On the Schedule Interval page, set when the agent runs:
   • Schedule: Choose a preset interval (Hourly, Daily, Weekly, Monthly) or enter a custom cron expression.
   • On-Demand: No automatic schedule; trigger the agent manually when needed.
   
6. Click Add to deploy the agent.

​

Troubleshooting