A developer is building a telemetry ingestion pipeline where an Amazon EventBridge rule routes custom device events to an Amazon Kinesis Data Stream target. The event payloads contain a nested JSON structure like the following:
{
"version": "2026-07-15",
"detail-type": "DeviceTelemetry",
"source": "my.company.iot",
"detail": {
"device_id": "dev-98765",
"region": "us-west-2",
"metrics": {
"temperature": 42.5
}
}
}
During load testing, the developer observes two issues:
1. All events are being routed to a single shard in the Kinesis stream, causing write throttling (`ProvisionedThroughputExceededException`).
2. Some events are dropped entirely with delivery failures, and the EventBridge target invocation logs show access denied errors.
Which combination of configuration changes will resolve both the write throttling and the event delivery failures?
- AConfigure the EventBridge rule target with a Partition Key Path of `$.detail-type`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `events.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.
- BRoute the EventBridge rule to an intermediate AWS Lambda function deployed in a private VPC subnet without a NAT Gateway or VPC endpoint to write the events to Kinesis. Attach an IAM role to the Lambda function with a trust policy allowing the `lambda.amazonaws.com` service principal to assume the role.
- Configure the EventBridge rule target with a Partition Key Path of `$.detail.device_id`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `events.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.Answer
- DConfigure the EventBridge rule target with a Partition Key Path of `$.detail.device_id`. Attach an IAM role to the EventBridge rule that has a trust policy allowing the `kinesis.amazonaws.com` service principal to assume the role, and an identity-based policy allowing the `kinesis:PutRecord` action on the target stream.