AWS::KinesisFirehose::DeliveryStream SecretsManagerConfiguration - Amazon CloudFormation
SyntaxProperties
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWS::KinesisFirehose::DeliveryStream SecretsManagerConfiguration

The structure that defines how Firehose accesses the secret.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Enabled" : Boolean,
  "RoleARN" : String,
  "SecretARN" : String
}

YAML

  Enabled: Boolean
  RoleARN: String
  SecretARN: String

Properties

Enabled

Specifies whether you want to use the the secrets manager feature. When set as True the secrets manager configuration overwrites the existing secrets in the destination configuration. When it's set to False Firehose falls back to the credentials in the destination configuration.

Required: Yes

Type: Boolean

Update requires: No interruption

RoleARN

Specifies the role that Firehose assumes when calling the Secrets Manager API operation. When you provide the role, it overrides any destination specific role defined in the destination configuration. If you do not provide the then we use the destination specific role. This parameter is required for Splunk.

Required: No

Type: String

Pattern: arn:.*

Minimum: 1

Maximum: 512

Update requires: No interruption

SecretARN

The ARN of the secret that stores your credentials. It must be in the same region as the Firehose stream and the role. The secret ARN can reside in a different account than the delivery stream and role as Firehose supports cross-account secret access. This parameter is required when Enabled is set to True.

Required: No

Type: String

Pattern: arn:.*

Minimum: 1

Maximum: 512

Update requires: No interruption