> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant KMS access to the EventBridge Pipe

> Add Kinesis and Amazon EventBridge Pipe statements to a customer-managed KMS key so the Cloud Collector can decrypt Contact Trace Records.

If your Kinesis stream is encrypted with a customer-managed KMS key (CMK), grant
the Cloud Collector's Amazon EventBridge Pipe execution role the KMS actions it
needs to decrypt Contact Trace Records (CTRs) from Kinesis.

## Before you start

* A Kinesis stream encrypted with a customer-managed KMS key. AWS
  managed keys (`aws/kinesis`) need no extra policy work.
* The deployed [Cloud Collector](/docs/concepts-cloud-collector) — the
  CloudFormation stack you installed in
  [Install CTR collection](/docs/ctr-installation).
* Two values from the stack:
  * The ARN of the Kinesis stream the pipe reads from.
  * The ARN of the EventBridge Pipe execution role (CloudFormation
    output `EventBridgePipeRoleArn`).
* IAM permission to edit the KMS key policy.

The Cloud Collector needs five KMS actions on the CMK:

```text theme={null}
kms:Encrypt
kms:Decrypt
kms:ReEncrypt*
kms:GenerateDataKey*
kms:DescribeKey
```

## Steps

### 1. Open the KMS key

In the AWS console, open **KMS → Customer managed keys** and select
the key the Kinesis stream uses.

### 2. Edit the key policy

Under **Key policy**, click **Switch to policy view** (if you're in
the default view) and then **Edit**.

### 3. Add the Kinesis and Pipe statements

Append the following two statements to the `Statement` array.
Substitute your real Kinesis stream ARN and EventBridge Pipe role ARN
for the placeholders.

```json theme={null}
{
  "Sid": "AllowKinesisStreamEncryption",
  "Effect": "Allow",
  "Principal": {
    "AWS": "*"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:ReEncrypt*",
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
  ],
  "Resource": "{Kinesis Stream ARN}"
},
{
  "Sid": "AllowEventBridgePipeDecrypt",
  "Effect": "Allow",
  "Principal": {
    "AWS": "{Execution Role of EventBridge Pipe}"
  },
  "Action": "kms:Decrypt",
  "Resource": "*"
}
```

A worked example:

```json theme={null}
"Resource": "arn:aws:kinesis:us-east-1:8012345678:stream/Operata-Kinesis"
"Principal": {
  "AWS": "arn:aws:iam::8012345678:role/OperataAWSIntegration-CTR-operataEventBridgePipeRol-R2GazQu5D7mk"
}
```

### 4. Save the policy

Click **Finish** to save. KMS key policy changes take effect
immediately.

## Verify

Place a test contact through Amazon Connect and confirm the CTR
appears in the Operata console within five minutes. If it doesn't,
check the EventBridge Pipe in the AWS console for a `KMSAccessDenied`
error and re-check the Principal ARN you pasted into the second
statement.

## Related

* [Troubleshoot the AWS integration](/docs/aws-troubleshooting) — covers KMS-related delivery failures.
* [IAM policies reference](/docs/iam-policies) — the rest of the roles the EventBridge Pipe needs.
* [Concept: Cloud Collector](/docs/concepts-cloud-collector) — what the pipe does once it can read the stream.