AWS streams documentation change
Summary
Expanded tagging documentation to include enhanced fan-out consumers, updated console instructions, and added IAM permission requirements for tagging during resource creation
Security assessment
The change adds an 'Important' note specifying required IAM permissions (kinesis:CreateStream, kinesis:AddTagsToStream, kinesis:TagResource) for tagging during stream creation and consumer registration. While this clarifies security controls, there is no evidence of addressing a specific vulnerability.
Diff
diff --git a/streams/latest/dev/tagging.md b/streams/latest/dev/tagging.md index 533a05c90..47368494f 100644 --- a//streams/latest/dev/tagging.md +++ b//streams/latest/dev/tagging.md @@ -5 +5 @@ -Review tag basicsTrack costs using taggingUnderstand tag restrictionsTag streams using the Kinesis Data Streams consoleTag streams using the AWS CLITag streams using the Kinesis Data Streams API +Review tag basicsTrack costs using taggingUnderstand tag restrictionsTag streams using the Kinesis Data Streams consoleTag streams using the AWS CLITag streams using the Kinesis Data Streams APIsTag consumers using the AWS CLITag consumers using the Kinesis Data Streams APIs @@ -7 +7 @@ Review tag basicsTrack costs using taggingUnderstand tag restrictionsTag streams -# Tag your streams in Amazon Kinesis Data Streams +# Tag your Amazon Kinesis Data Streams resources @@ -9 +9 @@ Review tag basicsTrack costs using taggingUnderstand tag restrictionsTag streams -You can assign your own metadata to streams you create in Amazon Kinesis Data Streams in the form of _tags_. A tag is a key-value pair that you define for a stream. Using tags is a simple yet powerful way to manage AWS resources and organize data, including billing data. +You can assign your own metadata to streams and enhanced fan-out consumers you create in Amazon Kinesis Data Streams in the form of _tags_. A tag is a key-value pair that you define for a stream. Using tags is a simple yet powerful way to manage AWS resources and organize data, including billing data. @@ -23 +23,5 @@ You can assign your own metadata to streams you create in Amazon Kinesis Data St - * Tag streams using the Kinesis Data Streams API + * Tag streams using the Kinesis Data Streams APIs + + * Tag consumers using the AWS CLI + + * Tag consumers using the Kinesis Data Streams APIs @@ -30 +34,5 @@ You can assign your own metadata to streams you create in Amazon Kinesis Data St -You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API to complete the following tasks: +The Kinesis Data Streams resources you can tag include data streams and enhanced fan-out consumers. You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API to complete the following tasks: + + * Create a resource with tags + + * Add tags to a resource @@ -32 +40 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t - * Create a stream with tags + * List the tags for your resources @@ -34 +42 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t - * Add tags to a stream + * Remove tags from a resource @@ -36 +43,0 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t - * List the tags for your streams @@ -38 +44,0 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t - * Remove tags from a stream @@ -40,0 +47 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t +###### Note @@ -41,0 +49 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t +You can't apply tags to enhanced fan-out consumers using the Kinesis Data Streams console. For applying tags to consumers, use AWS CLI or Kinesis Data Streams API. @@ -43 +51 @@ You use the Kinesis Data Streams console, AWS CLI, or Kinesis Data Streams API t -You can use tags to categorize your streams. For example, you can categorize streams by purpose, owner, or environment. Because you define the key and value for each tag, you can create a custom set of categories to meet your specific needs. For example, you might define a set of tags that helps you track streams by owner and associated application. Here are several examples of tags: +You can use tags to categorize your resources. For example, you can categorize resources by purpose, owner, or environment. Because you define the key and value for each tag, you can create a custom set of categories to meet your specific needs. For example, you might define a set of tags that helps you track resources by owner and associated application. Here are several examples of tags: @@ -57,0 +66,9 @@ You can use tags to categorize your streams. For example, you can categorize str +###### Important + + * To add tags while creating a stream, you must include the `kinesis:CreateStream` and `kinesis:AddTagsToStream` permissions for that stream. You **can't use** the `kinesis:TagResource` permission to tag streams while creating them. + + * To add tags during consumer registration, you must include the `kinesis:TagResource` and `kinesis:RegisterStreamConsumer` permissions. + + + + @@ -60 +77 @@ You can use tags to categorize your streams. For example, you can categorize str -You can use tags to categorize and track your AWS costs. When you apply tags to your AWS resources, including streams, your AWS cost allocation report includes usage and costs aggregated by tags. You can apply tags that represent business categories (such as cost centers, application names, or owners) to organize your costs across multiple services. For more information, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing User Guide_. +You can use tags to categorize and track your AWS costs. When you apply tags to your Kinesis Data Streams resources, your AWS cost allocation report includes usage and costs aggregated by tags. You can apply tags that represent business categories, such as cost centers, application names, or owners, to organize your costs across multiple services. For more information, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing User Guide_. @@ -64 +81 @@ You can use tags to categorize and track your AWS costs. When you apply tags to -The following restrictions apply to tags. +The following restrictions apply to tags: @@ -68 +85 @@ The following restrictions apply to tags. - * The maximum number of tags per resource (stream) is 50. + * The maximum number of tags for each resource is 50. @@ -72 +89 @@ The following restrictions apply to tags. - * You can't change or edit tags for a deleted stream. + * You can't change or edit tags for a deleted resource. @@ -101 +118 @@ The following restrictions apply to tags. -You can add, list, and remove tags using the Kinesis Data Streams console. +You can add, update, list, and remove tags on your streams using the Kinesis Data Streams console. @@ -105 +122 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 1. Open the Kinesis Data Streams console. In the navigation bar, expand the Region selector and select a Region. + 1. Sign in to the AWS Management Console and open the Kinesis console at [https://console.aws.amazon.com/kinesis](https://console.aws.amazon.com/kinesis). @@ -107 +124 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 2. On the **Stream List** page, select a stream. + 2. On the left navigation pane, choose **Data streams**. @@ -109 +126,5 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 3. On the **Stream Details** page, choose the **Tags** tab. + 3. On the **Data streams** page, choose the stream that you want to tag. + + 4. On the Stream details page, choose **Configuration**. + + 5. In the **Tags** section, view the tags applied to the stream. @@ -116 +137,3 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 1. Open the Kinesis Data Streams console. In the navigation bar, expand the Region selector and select a Region. + 1. Open the Kinesis Data Streams console. + + 2. On the left navigation pane, choose **Data streams**. @@ -118 +141 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 2. Choose **Create a stream**. + 3. Choose **Create data stream**. @@ -120 +143 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 3. On the **Create data stream** page, enter a name for your data stream and then choose either the **On-demand** or the **Provisioned** capacity mode. The On-demand mode is selected by default. For more information, see [Choose the data stream capacity mode](./how-do-i-size-a-stream.html). + 4. On the **Create data stream** page, enter a name for your data stream. @@ -122 +145 @@ You can add, list, and remove tags using the Kinesis Data Streams console. - 4. In the **Tags** section, choose **Add new tag**. Specify the tag in the **Key** field, and optionally specify a value in the **Value** field. + 5. For **Data stream capacity** , choose either the **On-demand** or the **Provisioned** capacity mode. @@ -124 +147 @@ You can add, list, and remove tags using the Kinesis Data Streams console. -If you see an error, either the tag key or value that you specified don't meet the tag restrictions. For more information, see Understand tag restrictions. +For more information about capacity modes, see [Choose the data stream capacity mode](./how-do-i-size-a-stream.html). @@ -126 +149 @@ If you see an error, either the tag key or value that you specified don't meet t - 5. Choose **Create data stream**. + 6. In the **Tags** section, do the following: @@ -128 +151 @@ If you see an error, either the tag key or value that you specified don't meet t - 6. On the **Data streams** page, your stream's **Status** displays as **Creating** while the stream is being created. When the stream is ready to use, the status changes to **Active**. + 1. Choose **Add new tag**. @@ -130 +153 @@ If you see an error, either the tag key or value that you specified don't meet t - 7. Choose the name of your stream. The **Stream Details** page displays a summary of your stream configuration, along with monitoring information. + 2. For **Key** , enter the tag and optionally specify a value in the **Value** field. @@ -131,0 +155 @@ If you see an error, either the tag key or value that you specified don't meet t +If you see an error, either the tag key or value that you specified doesn't meet the tag restrictions. For more information, see Understand tag restrictions. @@ -132,0 +157 @@ If you see an error, either the tag key or value that you specified don't meet t + 7. Choose **Create data stream**. @@ -135 +159,0 @@ If you see an error, either the tag key or value that you specified don't meet t -###### To add a tag to a stream @@ -137 +160,0 @@ If you see an error, either the tag key or value that you specified don't meet t - 1. Open the Kinesis Data Streams console. In the navigation bar, expand the Region selector and select a Region. @@ -139 +162 @@ If you see an error, either the tag key or value that you specified don't meet t - 2. On the **Stream List** page, select a stream. +###### To add or update a tag on a stream @@ -141 +164 @@ If you see an error, either the tag key or value that you specified don't meet t - 3. On the **Stream Details** page, choose the **Tags** tab. + 1. Open the Kinesis Data Streams console. @@ -143 +166 @@ If you see an error, either the tag key or value that you specified don't meet t - 4. Specify the tag key in the **Key** field, optionally specify a tag value in the **Value** field, and then choose **Add Tag**. + 2. On the left navigation pane, choose **Data streams**. @@ -145 +168 @@ If you see an error, either the tag key or value that you specified don't meet t -If the **Add Tag** button is not enabled, either the tag key or tag value that you specified don't meet the tag restrictions. For more information, see Understand tag restrictions. + 3. On the **Data streams** page, choose the stream to which you want to add or update tags. @@ -147 +170,15 @@ If the **Add Tag** button is not enabled, either the tag key or tag value that y - 5. To view your new tag in the list on the **Tags** tab, choose the refresh icon. + 4. On the Stream details page, choose **Configuration**. + + 5. In the **Tags** section, choose **Manage tags**. + + 6. Under **Tags** , do one of the following: + + * To add a new tag, choose **Add new tag** , and then enter the tag's **Key** and **Value** data. Repeat this step as many times as necessary. + +The maximum number of tags you can add for each stream is 50. + + * To update an existing tag, enter a new tag value in the **Value** field of that tag's **Key**. + +If you see an error, either the tag key or value that you specified doesn't meet the tag restrictions. For more information, see Understand tag restrictions. + + 7. Choose **Save changes**. @@ -154 +191 @@ If the **Add Tag** button is not enabled, either the tag key or tag value that y - 1. Open the Kinesis Data Streams console. In the navigation bar, expand the Region selector and select a Region. + 1. Open the Kinesis Data Streams console. @@ -156 +193 @@ If the **Add Tag** button is not enabled, either the tag key or tag value that y - 2. On the Stream List page, select a stream. + 2. On the left navigation pane, choose **Data streams**. @@ -158 +195 @@ If the **Add Tag** button is not enabled, either the tag key or tag value that y - 3. On the Stream Details page, choose the **Tags** tab, and then choose the **Remove** icon for the tag. + 3. On the **Data streams** page, choose the stream from which you want to remove tags. @@ -160 +197,7 @@ If the **Add Tag** button is not enabled, either the tag key or tag value that y - 4. In the **Delete Tag** dialog box, choose **Yes, Delete**. + 4. On the Stream details page, choose **Configuration**. + + 5. In the **Tags** section, choose **Manage tags**. + + 6. Find the tag **Key** and **Value** pair that you want to remove. Then, choose **Remove**. + + 7. Choose **Save changes**. @@ -167 +210 @@ If the **Add Tag** button is not enabled, either the tag key or tag value that y -You can add, list, and remove tags using the AWS CLI. For examples, see the following documentation. +You can add, list, and remove tags on your streams using the AWS CLI. For examples, see the following documentation. @@ -189 +232 @@ Removes tags from the specified stream. -## Tag streams using the Kinesis Data Streams API +## Tag streams using the Kinesis Data Streams APIs @@ -191 +234 @@ Removes tags from the specified stream. -You can add, list, and remove tags using the Kinesis Data Streams API. For examples, see the following documentation: +You can add, list, and remove tags on your streams using the Kinesis Data Streams APIs. For examples, see the following documentation: @@ -212,0 +256,48 @@ Removes tags from the specified stream. +## Tag consumers using the AWS CLI + +You can add, list, and remove tags on your consumers using the AWS CLI. For examples, see the following documentation: + +[register-stream-consumer](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kinesis/register-stream-consumer.html) + + +Registers a consumer for a Kinesis data stream with tags. + +[tag-resource](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kinesis/tag-resource.html) + + +Adds or updates tags for the specified Kinesis resource. + +[list-tags-for-resource](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kinesis/list-tags-for-resource.html) + + +Lists the tags for the specified Kinesis resource. + +[untag-resource](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/kinesis/untag-resource.html) + + +Removes tags from the specified Kinesis resource. + +## Tag consumers using the Kinesis Data Streams APIs + +You can add, list, and remove tags on your consumers using the Kinesis Data Streams APIs. For examples, see the following documentation: