Skip to main content
If your Kinesis stream is encrypted with a customer-managed KMS key (CMK), grant the Cloud Collector’s Amazon EventBridge Pipe execution role the KMS actions it needs to decrypt Contact Trace Records (CTRs) from Kinesis.

​
Before you start

  • A Kinesis stream encrypted with a customer-managed KMS key. AWS managed keys (aws/kinesis) need no extra policy work.
  • The deployed Cloud Collector — the CloudFormation stack you installed in Install CTR collection.
  • Two values from the stack:
    • The ARN of the Kinesis stream the pipe reads from.
    • The ARN of the EventBridge Pipe execution role (CloudFormation output EventBridgePipeRoleArn).
  • IAM permission to edit the KMS key policy.
The Cloud Collector needs five KMS actions on the CMK:

​
Steps

​
1. Open the KMS key

In the AWS console, open KMS → Customer managed keys and select the key the Kinesis stream uses.

​
2. Edit the key policy

Under Key policy, click Switch to policy view (if you’re in the default view) and then Edit.

​
3. Add the Kinesis and Pipe statements

Append the following two statements to the Statement array. Substitute your real Kinesis stream ARN and EventBridge Pipe role ARN for the placeholders.
A worked example:

​
4. Save the policy

Click Finish to save. KMS key policy changes take effect immediately.

​
Verify

Place a test contact through Amazon Connect and confirm the CTR appears in the Operata console within five minutes. If it doesn’t, check the EventBridge Pipe in the AWS console for a KMSAccessDenied error and re-check the Principal ARN you pasted into the second statement.