Amazon Data Firehose

import { defineBackend } from "@aws-amplify/backend";
import { auth } from "./auth/resource";
import { data } from "./data/resource";
import { storage } from "./storage/resource";
import { CfnDeliveryStream } from "aws-cdk-lib/aws-kinesisfirehose";
import { Stack } from "aws-cdk-lib/core";
import {
  Policy,
  PolicyStatement,
  Role,
  ServicePrincipal,
} from "aws-cdk-lib/aws-iam";

const backend = defineBackend({
  auth,
  data,
  storage,
});

const firehoseStack = backend.createStack("firehose-stack");

// Access the S3 bucket resource
const s3Bucket = backend.storage.resources.bucket;

// Create a new IAM role for the Firehose
const firehoseRole = new Role(firehoseStack, "FirehoseRole", {
  assumedBy: new ServicePrincipal("firehose.amazonaws.com"),
});

// Grant the Firehose role read/write permissions to the S3 bucket
s3Bucket.grantReadWrite(firehoseRole);

// Create a Firehose delivery stream
const myFirehose = new CfnDeliveryStream(firehoseStack, "MyFirehose", {
  deliveryStreamType: "DirectPut",
  s3DestinationConfiguration: {
    bucketArn: s3Bucket.bucketArn,
    roleArn: firehoseRole.roleArn,
  },
  deliveryStreamName: "myFirehose",
});

// Grant PutRecordBatch permission to authenticated users
const firehosePolicy = new Policy(firehoseStack, "FirehosePolicy", {
  statements: [
    new PolicyStatement({
      actions: ["firehose:PutRecordBatch"],
      resources: [myFirehose.attrArn],
    }),
  ],
});

backend.auth.resources.authenticatedUserIamRole.attachInlinePolicy(firehosePolicy);

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "firehose:PutRecordBatch",
    "Resource": "arn:aws:firehose:<region>:<account-id>:deliverystream/<stream-name>"
  }]
}