> This page is for Developers.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.emnify.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.emnify.com/_mcp/server.

# AWS (S3 and Kinesis) Data Streamer integration

> Integrate with AWS S3 and Kinesis Data Streamer using IAM roles and trust relationships for secure data streaming.

AWS integrations are securely configured by means of a trust relationship of the emnify Data Streamer role (`arn:aws:iam::884047677700:role/datastreamer`).
The trust relationship can be added to new or existing roles.

The following JSON shows an example policy document that should be added in the trust relationship:

```json maxLines=0
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::884047677700:role/datastreamer"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "sts:ExternalId": [
            "org-1234"
          ]
        }
      }
    }
  ]
}
```

> **Note**
>
> The `ExternalID` must match with the emnify organization number, so for an organization with a numeric ID of `1234`, this value shows `org-1234`.
> The numeric ID of an organization can be retrieved with a call to `/organisation/my`.

## S3 AWS configuration

This section covers the steps necessary to create a new role with S3 write access.

In the AWS console, navigate to **S3** and create a new bucket.

In **IAM** > **Policies**, click **Create Policy** to create a policy which allows `PutObject` permissions to the S3 bucket.

In **IAM** > **Roles**, click **Create Role** for the S3 use case and click **Next: Permissions**.

Attach the policy created in step 2 and click **Next: Tags**, then **Create Role**.

Edit the newly created role and click **Trust Relationships** > **Edit Trust Relationships**.

Copy the policy document JSON from the beginning of this guide with your organization ID in place to allow emnify's Data Streamer role write access.

> **Info**
>
> Bucket names should be DNS-compliant, see [Bucket Naming Rules in the AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketRestrictions.html#bucket-naming-limits).

## Kinesis AWS configuration

This section covers the steps necessary to create a new role with Kinesis write access.

In the AWS console, navigate to Kinesis and create a new stream.

In **IAM** > **Policies** click **Create Policy**, which allows `PutRecord` and `PutRecords` write permissions to the Kinesis stream.

In **IAM** > **Roles**, click **Create Role** for **Kinesis Analytics** and click **Next: Permissions**.

Attach the policy created in step 2 and click **Next: Tags** > **Create Role**.

Edit the newly created role and click **Trust Relationships** > **Edit Trust Relationships**.

Copy the policy document JSON from the beginning of this guide with your organization ID in place to allow emnify's Data Streamer role write access.