---
title: "Amazon Data Firehose"
section: "build-a-backend/add-aws-services/analytics"
platforms: ["android", "flutter", "swift"]
gen: 2
last-updated: "2026-05-11T17:44:11.000Z"
url: "https://docs.amplify.aws/react/build-a-backend/add-aws-services/analytics/firehose/"
---

Use the [AWS Cloud Development Kit (AWS CDK)](https://docs.aws.amazon.com/cdk/latest/guide/home.html) to create an [Amazon Data Firehose](https://aws.amazon.com/firehose/) delivery stream and grant your app the permissions it needs. For more on adding custom AWS resources to your Amplify backend, see [Custom resources](/[platform]/build-a-backend/add-aws-services/custom-resources/).

## Set up a Firehose delivery stream

```ts title="amplify/backend.ts"
import { defineBackend } from "@aws-amplify/backend";
import { auth } from "./auth/resource";
import { data } from "./data/resource";
import { storage } from "./storage/resource";
import { CfnDeliveryStream } from "aws-cdk-lib/aws-kinesisfirehose";
import { Stack } from "aws-cdk-lib/core";
import {
  Policy,
  PolicyStatement,
  Role,
  ServicePrincipal,
} from "aws-cdk-lib/aws-iam";

const backend = defineBackend({
  auth,
  data,
  storage,
});

const firehoseStack = backend.createStack("firehose-stack");

// Access the S3 bucket resource
const s3Bucket = backend.storage.resources.bucket;

// Create a new IAM role for the Firehose
const firehoseRole = new Role(firehoseStack, "FirehoseRole", {
  assumedBy: new ServicePrincipal("firehose.amazonaws.com"),
});

// Grant the Firehose role read/write permissions to the S3 bucket
s3Bucket.grantReadWrite(firehoseRole);

// Create a Firehose delivery stream
const myFirehose = new CfnDeliveryStream(firehoseStack, "MyFirehose", {
  deliveryStreamType: "DirectPut",
  s3DestinationConfiguration: {
    bucketArn: s3Bucket.bucketArn,
    roleArn: firehoseRole.roleArn,
  },
  deliveryStreamName: "myFirehose",
});

// Grant PutRecordBatch permission to authenticated users
const firehosePolicy = new Policy(firehoseStack, "FirehosePolicy", {
  statements: [
    new PolicyStatement({
      actions: ["firehose:PutRecordBatch"],
      resources: [myFirehose.attrArn],
    }),
  ],
});

backend.auth.resources.authenticatedUserIamRole.attachInlinePolicy(firehosePolicy);
```

If you are not using the CDK, ensure your authenticated IAM role has the `firehose:PutRecordBatch` permission on your target delivery stream:

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "firehose:PutRecordBatch",
    "Resource": "arn:aws:firehose:<region>:<account-id>:deliverystream/<stream-name>"
  }]
}
```

For more information, see the [Amazon Data Firehose Developer Documentation](https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html).

> **Warning:** Ensure your S3 destination bucket is properly secured. See [Security best practices for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html) for guidance on encryption, access control, and logging.

## Next steps

Use the [Firehose client](/[platform]/frontend/analytics/firehose/) to stream data from your app.