Examkin

Question

Difficulty: HardStream Processing and Event Routing with Amazon Kinesis and EventBridge

An application team is designing a real-time fraud detection system for a mobile payments platform. The application publishes transaction details as JSON events to a custom Amazon EventBridge event bus. A developer must create an EventBridge rule that filters transaction events to identify high-value payments exceeding 50005000 USD and routes them directly to an Amazon Kinesis Data Stream. The solution must ensure that transactions from the same user are processed in the order they occurred, without causing hot shards under normal load, and that the rule has the necessary access to publish to the stream. Which TWO configurations must the developer implement to meet these requirements?

  1. Configure the EventBridge rule target with the PartitionKeyPath parameter set to $.detail.userId to route events for the same user to the same Kinesis shard.Answer
  2. Create an IAM role with a trust policy that allows the events.amazonaws.com service principal to perform sts:AssumeRole, and a permission policy that grants the role kinesis:PutRecord permissions on the Kinesis stream.Answer
  3. C
    Configure the EventBridge rule target with the PartitionKeyPath parameter set to $.detail.status to group and order all events by their transaction completion status.
  4. D
    Create an IAM role with a permission policy that allows the events.amazonaws.com service principal to perform the sts:AssumeRole action, and a trust policy that allows kinesis:PutRecord on the Kinesis stream.
  5. E
    Route the filtered events from EventBridge to a custom Lambda function deployed in a private VPC subnet with no NAT Gateway or VPC endpoint to forward the records to the Kinesis stream.

Answer

The developer must configure the EventBridge target with a PartitionKeyPath pointing to the user ID payload attribute, and assign an IAM role whose trust policy permits the EventBridge service principal to assume it and whose permissions policy allows writing to the Kinesis stream.
The correct options implement the appropriate target parameters and cross-service permissions. Specifying the user ID as the PartitionKeyPath ensures ordered delivery per user while avoiding hot shards. Providing an IAM role with a trust policy allowing the EventBridge service principal to assume it and permission policy allowing kinesis:PutRecord allows EventBridge to successfully write the filtered events to the Kinesis stream.

Step-by-Step Solution

1
Evaluate partitioning and ordering constraints.
Identify that Kinesis preserves transaction order within a single shard based on the partition key. To prevent hot shards and guarantee per-user ordering, a high-entropy field like the user ID must be chosen.
Choosing a low-entropy field like transaction status causes uneven shard utilization and fails the user-specific ordering requirement.
2
Set the target parameters in the EventBridge rule.
Configure the PartitionKeyPath target property using the JSONPath expression $.detail.userId.
This extracts the user ID from the EventBridge event detail payload and applies it as the partition key for Kinesis.
3
Define cross-service IAM authorization.
Create an IAM role allowing the events.amazonaws.com principal to assume the role, and associate a policy that allows kinesis:PutRecord on the target stream.
EventBridge needs explicit trust configuration to assume the role and permissions to write events to the stream.

Key Concept

Routing events from Amazon EventBridge to Amazon Kinesis Data Streams requires specifying a target JSONPath-based partition key for ordering and shard distribution, along with establishing an IAM trust relationship and permission boundary for EventBridge.
Rate this question

Topics

Stream Processing and Event Routing with Amazon Kinesis and EventBridge

More questions from this topic