> ## Documentation Index
> Fetch the complete documentation index at: https://private-7c7dfe99-fix-nav-issues.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Kinesis Role-Based Access

> This article demonstrates how ClickPipes customers can leverage role-based access to authenticate with Amazon Kinesis and access their data streams securely.

export const Image = ({img, alt, size}) => {
  return <Frame>
      <img src={img} alt={alt} />
    </Frame>;
};

This article demonstrates how ClickPipes customers can leverage role-based access to authenticate with Amazon Kinesis and access their data streams securely.

<h2 id="prerequisite">
  Prerequisites
</h2>

To follow this guide, you will need:

* An active ClickHouse Cloud service
* An AWS account

<h2 id="introduction">
  Introduction
</h2>

Before diving into the setup for secure Kinesis access, it's important to understand the mechanism. Here's an overview of how ClickPipes can access Amazon Kinesis streams by assuming a role within customers' AWS accounts.

<Image img="https://mintcdn.com/private-7c7dfe99-fix-nav-issues/8xU-7NRzcVe16bmG/images/integrations/data-ingestion/clickpipes/securekinesis.jpg?fit=max&auto=format&n=8xU-7NRzcVe16bmG&q=85&s=67a4971319a0f8a3cf57f1e55a0f4f02" alt="Secure Kinesis" size="lg" border width="2049" height="907" data-path="images/integrations/data-ingestion/clickpipes/securekinesis.jpg" />

Using this approach, customers can manage all access to their Kinesis data streams in a single place (the IAM policy of the assumed-role) without having to modify each stream's access policy individually.

<h2 id="setup">
  Setup
</h2>

<h3 id="obtaining-the-clickhouse-service-iam-role-arn">
  Obtaining the ClickHouse service IAM role Arn
</h3>

* 1. Login to your ClickHouse cloud account.
* 2. Select the ClickHouse service you want to create the integration
* 3. Select the **Settings** tab
* 4. Scroll down to the **Network security information** section at the bottom of the page
* 5. Copy the **Service role ID (IAM)** value belong to the service as shown below.

<Image img="https://mintcdn.com/private-7c7dfe99-fix-nav-issues/pb3p2qvhHWkIWhRw/images/cloud/security/secures3_arn.png?fit=max&auto=format&n=pb3p2qvhHWkIWhRw&q=85&s=8f9e668058fb087a51c04fc7c39f5bea" alt="Secure S3 ARN" size="lg" border width="1222" height="254" data-path="images/cloud/security/secures3_arn.png" />

<h3 id="setting-up-iam-assume-role">
  Setting up IAM assume role
</h3>

<h4 id="manually-create-iam-role">
  Manually create IAM role.
</h4>

* 1. Login to your AWS Account in the web browser with an IAM user that has permission to create & manage IAM role.

* 2. Browse to IAM Service Console

* 3. Create a new IAM role with Trusted Entity Type of `AWS account`. Note that the name of the IAM role **must start with** `ClickHouseAccessRole-` for this to work.

  **i. Configure the Trust Policy**

  The trust policy allows the ClickHouse IAM role to assume this role. Replace `{ClickHouse_IAM_ARN}` with the IAM Role ARN from your ClickHouse service (obtained in the previous step).

  ```json theme={null}
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "{ClickHouse_IAM_ARN}"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  ```

  **ii. Configure the Permission Policy**

  The permission policy grants access to your Kinesis stream. Replace the following placeholders:

  * `{REGION}`: Your AWS region (e.g., `us-east-1`)
  * `{ACCOUNT_ID}`: Your AWS account ID
  * `{STREAM_NAME}`: Your Kinesis stream name

  ```json theme={null}
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "kinesis:DescribeStream",
          "kinesis:GetShardIterator",
          "kinesis:GetRecords",
          "kinesis:ListShards",
          "kinesis:RegisterStreamConsumer",
          "kinesis:DeregisterStreamConsumer",
          "kinesis:ListStreamConsumers"
        ],
        "Resource": [
          "arn:aws:kinesis:{REGION}:{ACCOUNT_ID}:stream/{STREAM_NAME}"
        ]
      },
      {
        "Effect": "Allow",
        "Action": [
          "kinesis:SubscribeToShard",
          "kinesis:DescribeStreamConsumer"
        ],
        "Resource": [
          "arn:aws:kinesis:{REGION}:{ACCOUNT_ID}:stream/{STREAM_NAME}/*"
        ]
      },
      {
        "Effect": "Allow",
        "Action": [
          "kinesis:ListStreams"
        ],
        "Resource": "*"
      }
    ]
  }
  ```

* 4. Copy the new **IAM Role Arn** after creation. This is what is needed to access your Kinesis stream.