> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getcollate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Kinesis Firehose Hybrid Runner | Official Documentation

> Ingest AWS Kinesis Firehose pipeline metadata to track data delivery streams and manage operational lineage using the Hybrid Runner.

export const ConnectorDetailsHeader = ({name, icon, stage, availableFeatures, unavailableFeatures = [], availableFeaturesCollate = []}) => {
  const showSubHeading = availableFeatures?.length > 0 || unavailableFeatures?.length > 0 || availableFeaturesCollate?.length > 0;
  const totalAvailableFeatures = [...availableFeatures || [], ...availableFeaturesCollate || []];
  return <div className="container">
      <div className="Heading">
        <div className="flex items-center gap-3">
          {icon && <div className="IconContainer">
              <img src={icon} alt={name} noZoom className="ConnectorIcon" />
            </div>}
          <h1 className="ConnectorName">{name}</h1>
          <span className={`StageBadge ${stage === 'PROD' ? 'prod' : 'beta'}`}>
            {stage}
          </span>
        </div>
      </div>
      {showSubHeading && <div className="SubHeading">
          <div className="FeaturesHeading">Feature List</div>
          <div className="FeaturesList">
            {totalAvailableFeatures.map(feature => <div className="FeatureTag AvailableFeature" key={feature}>
                ✓ {feature}
              </div>)}
            {unavailableFeatures.map(feature => <div className="FeatureTag UnavailableFeature" key={feature}>
                ✕ {feature}
              </div>)}
          </div>
        </div>}
    </div>;
};

export const MetadataIngestionUi = ({connector, selectServicePath, addNewServicePath, serviceConnectionPath}) => {
  return <>
   <p>
      To ingest metadata from your sources, you need to create a service connection.
      The service connects your source system with Collate. Once you create
      a service, you can use it to configure your ingestion workflows.<br />
      <br />
      To create a service connection and ingest your metadata, follow the steps below:
  </p>
  <Steps>
    <Step title="Select the Service">
    <ol>
          <li>
            On the left navigation bar, click <strong>Settings</strong>.
          </li>
          <li>
            On the next page, click <strong>Services</strong>, and then select the service.
            <img src="/public/images/connectors/visit-services-page.png" alt="Visit Services Page" />
          </li>
    </ol>
   </Step>


   <Step title="Create a New Service">

       To add a new service connection, click <strong>Add New Service</strong>.
      <img src="/public/images/connectors/create-new-service.png" alt="Create a new Service" />


   </Step>


     <Step title="Select the Connector">
       Select <strong>{connector}</strong> as the service type and click <strong>Next</strong>.


       {selectServicePath && <img src={selectServicePath} alt="Select Service" />}
   </Step>


   <Step title="Name and Describe your Service">
       Enter a unique, descriptive <strong>Service Name</strong> and <strong>Description</strong>.
       <ul>
         <li><strong>Service Name</strong>: Collate identifies services by their service name. Enter a name that distinguishes this deployment from other services, including other {connector} services you are ingesting metadata from.</li>
       </ul>


       <Note>
           The service name cannot be changed after it is set.
       </Note>


       {addNewServicePath && <img src={addNewServicePath} alt="Add New Service" />}
   </Step>


   <Step title="Configure the Service Connection">
       Set up the connection settings required for {connector}. <br /><br />

       Configure the following connection options to set up the service and start ingesting metadata from your sources. The right-hand panel displays help documentation for the selected connection type in the product UI

       {serviceConnectionPath && <img src={serviceConnectionPath} alt="Configure Service connection" />}
   </Step>
   </Steps>
   </>;
};

<ConnectorDetailsHeader icon="/public/images/connectors/kinesis-firehose.webp" name="KinesisFirehose" stage="PROD" availableFeatures={["Pipelines", "Lineage"]} unavailableFeatures={["Owners", "Tags", "Pipeline Status"]} />

In this section, we provide guides and references to use the AWS Kinesis Firehose connector.

Configure and schedule AWS Kinesis Firehose metadata and profiler workflows from the Collate UI:

* [Requirements](#requirements)
* [Metadata Ingestion](#metadata-ingestion)
* [Troubleshooting](/connectors/pipeline/kinesis-firehose/troubleshooting)

## Requirements

To extract metadata from AWS Kinesis Firehose, you need to configure AWS credentials with appropriate permissions:

* **AWS Credentials**: Valid AWS credentials (Access Key ID and Secret Access Key) or IAM role with permissions to access Kinesis Firehose
* **Permissions Required**:
  * `firehose:DescribeDeliveryStream` - To describe delivery stream details
  * `firehose:ListDeliveryStreams` - To list all delivery streams
  * `dynamodb:describe_kinesis_streaming_destination`- To describe dynamodb table destination kinesis stream

## Metadata Ingestion

<MetadataIngestionUi connector="AWS Kinesis Firehose" selectServicePath="/public/images/connectors/kinesis-firehose/select-service.png" addNewServicePath="/public/images/connectors/kinesis-firehose/add-new-service.png" serviceConnectionPath="/public/images/connectors/kinesis-firehose/service-connection.png" />

## Connection Details

<Steps>
  <Step title="Connection Details">
    * **AWS Access Key ID**: AWS Access Key ID is a unique identifier for your AWS account. It is used in combination with the Secret Access Key to authenticate API requests to AWS services. This is an optional field if you are using IAM roles or AWS profiles for authentication.

    * **AWS Secret Access Key**: AWS Secret Access Key is a secret key that is used in combination with the Access Key ID to cryptographically sign API requests to AWS services. Keep this value secure and never share it. This is an optional field if you are using IAM roles or AWS profiles for authentication.

    * **AWS Region**: AWS Region where your Kinesis Firehose delivery streams are deployed. This is a required field. Examples include:

      * `us-east-1` (US East - N. Virginia)
      * `us-west-2` (US West - Oregon)
      * `eu-west-1` (Europe - Ireland)
      * `ap-southeast-1` (Asia Pacific - Singapore)

      You can find the full list of AWS regions in the [AWS documentation](https://docs.aws.amazon.com/general/latest/gr/rande.html).

    * **AWS Session Token**: AWS Session Token is a temporary credential that is required when using temporary security credentials (such as those from AWS STS). This is typically used in scenarios involving:

      * Federated user access
      * Cross-account access
      * Temporary credentials from AWS STS AssumeRole operations

      This field is optional and only needed when using temporary credentials.

    * **Endpoint URL**: Custom endpoint URL for AWS services. This is useful when:

      * Connecting to AWS services through a VPC endpoint
      * Using AWS compatible services (like MinIO for S3-compatible storage)
      * Connecting to AWS GovCloud or other specialized AWS regions

      Leave this field empty to use the default AWS endpoints. Example format: `https://firehose.us-east-1.amazonaws.com`

    * **Profile Name**: The name of an AWS profile configured in your AWS credentials file (`~/.aws/credentials`). When specified, the connector will use the credentials associated with this profile. This is useful when you have multiple AWS accounts or different permission sets configured locally.

      Example profile names:

      * `default`
      * `production`
      * `development`

    * **Assume Role ARN**: The Amazon Resource Name (ARN) of an IAM role to assume for accessing Kinesis Firehose resources. This is useful for cross-account access scenarios where the Kinesis Firehose delivery streams exist in a different AWS account.

      Format: `arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME`

      Example: `arn:aws:iam::123456789012:role/KinesisFirehoseReadOnlyRole`

      When using Assume Role, ensure that:

      1. The role has a trust relationship with the account making the request
      2. The role has necessary permissions to access Kinesis Firehose

    * **Assume Role Session Name**: A unique identifier for the assumed role session. This helps to distinguish between different sessions when the same role is assumed by different users or services. AWS uses this value in CloudTrail logs to help with auditing.

      Default value: `OpenMetadataSession`

      You can customize this to include information like:

      * Username or service name
      * Environment (dev, staging, prod)
      * Timestamp or unique identifier

    * **Assume Role Source Identity**: The source identity to associate with the assumed role session. This is an optional field that provides additional context about who or what is assuming the role. The source identity information appears in AWS CloudTrail logs and can be useful for auditing and compliance purposes.

      Example: `openmetadata-ingestion-service`

    * **Messaging Service Name**: The Name of the ingested Kafka Messaging Service associated with this Firehose Pipeline Service upstream source.

      Example: `local_kafka`

    * **Pipeline Filter Pattern**: A regular expression pattern to filter which Kinesis Firehose delivery streams to include or exclude during metadata extraction. This helps you control which pipelines are ingested into OpenMetadata.

      **Include Filter Examples:**

      * `.*prod.*` - Include only delivery streams with "prod" in the name
      * `^analytics-.*` - Include only delivery streams starting with "analytics-"
      * `.*-data-stream$` - Include only delivery streams ending with "-data-stream"

      **Exclude Filter Examples:**

      * `.*test.*` - Exclude delivery streams with "test" in the name
      * `^temp-.*` - Exclude delivery streams starting with "temp-"

      Leave empty to include all delivery streams.
  </Step>

  <Step title="Test the Connection">
    Once the credentials have been added, click on *Test Connection* and *Save* the changes.

    <img src="https://mintcdn.com/collatedocs/L7psA65ao88vmcRI/public/images/connectors/test-connection.png?fit=max&auto=format&n=L7psA65ao88vmcRI&q=85&s=2133f0d65f18df1e57f69d2cc3bdeff4" alt="Test Connection" width="1494" height="310" data-path="public/images/connectors/test-connection.png" />
  </Step>

  <Step title="Configure Metadata Ingestion">
    In this step we will configure the metadata ingestion pipeline,
    Please follow the instructions below

    <img src="https://mintcdn.com/collatedocs/12mtkhFtvTP7FUxZ/public/images/connectors/configure-metadata-ingestion-pipeline.png?fit=max&auto=format&n=12mtkhFtvTP7FUxZ&q=85&s=b310e691eaec850bc9eda3ed0b8a340f" alt="Configure Metadata Ingestion" width="1508" height="1614" data-path="public/images/connectors/configure-metadata-ingestion-pipeline.png" />

    #### Metadata Ingestion Options

    * **Name**: This field refers to the name of ingestion pipeline, you can customize the name or use the generated name.
    * **Pipeline Filter Pattern (Optional)**: Use to pipeline filter patterns to control whether or not to include pipeline as part of metadata ingestion.
      * **Include**: Explicitly include pipeline by adding a list of comma-separated regular expressions to the Include field. OpenMetadata will include all pipeline with names matching one or more of the supplied regular expressions. All other schemas will be excluded.
      * **Exclude**: Explicitly exclude pipeline by adding a list of comma-separated regular expressions to the Exclude field. OpenMetadata will exclude all pipeline with names matching one or more of the supplied regular expressions. All other schemas will be included.
    * **Include lineage (toggle)**: Set the Include lineage toggle to control whether to include lineage between pipelines and data sources as part of metadata ingestion.
    * **Enable Debug Log (toggle)**: Set the Enable Debug Log toggle to set the default log level to debug.
    * **Mark Deleted Pipelines (toggle)**: Set the Mark Deleted Pipelines toggle to flag pipelines as soft-deleted if they are not present anymore in the source system.
  </Step>

  <Step title="Schedule the Ingestion and Deploy">
    Scheduling can be set up at an hourly, daily, weekly, or manual cadence. The
    timezone is in UTC. Select a Start Date to schedule for ingestion. It is
    optional to add an End Date.

    Review your configuration settings. If they match what you intended,
    click Deploy to create the service and schedule metadata ingestion.

    If something doesn't look right, click the Back button to return to the
    appropriate step and change the settings as needed.

    After configuring the workflow, you can click on Deploy to create the
    pipeline.

    <img src="https://mintcdn.com/collatedocs/piJyXg9wW6Ik1lg-/public/images/connectors/schedule.png?fit=max&auto=format&n=piJyXg9wW6Ik1lg-&q=85&s=f1add591824b44456f0e2ff259a21c6f" alt="Schedule the Workflow" width="2733" height="1083" data-path="public/images/connectors/schedule.png" />
  </Step>

  <Step title="View the Ingestion Pipeline">
    Once the workflow has been successfully deployed, you can view the
    Ingestion Pipeline running from the Service Page.

    <img src="https://mintcdn.com/collatedocs/cOe_QuHYxAbkMtTI/public/images/connectors/view-ingestion-pipeline.png?fit=max&auto=format&n=cOe_QuHYxAbkMtTI&q=85&s=8c754af74f99ee70e714f6f707b827e4" alt="View Ingestion Pipeline" width="2733" height="1271" data-path="public/images/connectors/view-ingestion-pipeline.png" />

    <Tip>
      If [AutoPilot](/how-to-guides/admin-guide/applications/autopilot) is enabled, workflows like usage tracking, data lineage, and similar tasks will be handled automatically. Users don’t need to set up or manage them - AutoPilot takes care of everything in the system.
    </Tip>
  </Step>
</Steps>

By successfully completing these steps, the lineage information for the service will be displayed.

<Tip>
  When using a **Hybrid Ingestion Runner**, any sensitive credential fields—such as passwords, API keys, or private keys—must reference secrets using the following format:

  ```
  password: secret:/my/database/password
  ```

  This applies **only to fields marked as secrets** in the connection form (these typically mask input and show a visibility toggle icon).
  For a complete guide on managing secrets in hybrid setups, see the [Hybrid Ingestion Runner Secret Management Guide](https://docs.getcollate.io/getting-started/day-1/hybrid-saas/hybrid-ingestion-runner#3.-manage-secrets-securely).
</Tip>

## Troubleshooting

<Columns cols={2}>
  <Card title="Kinesis Firehose Troubleshooting" href="/connectors/pipeline/kinesis-firehose/troubleshooting">
    Learn more about how to troubleshoot common Kinesis Firehose connector issues and resolve configuration or ingestion errors.
  </Card>
</Columns>