Skip to main content

Amazon Kinesis Data Firehose Source Returns Access Denied in Cribl Stream

  • September 11, 2026
  • 0 replies
  • 15 views
Jessica Bracken

Symptom

When using an Amazon Kinesis Data Firehose delivery stream configured with an HTTP endpoint to send data to Cribl Stream (including Cribl.Cloud worker groups), the source shows as connected but no events are delivered. Worker logs contain repeating errors similar to:

channel: "input:<your-firehose-source-id>" with message: "failed to process request" and response.errorMessage: "Access denied".

In some cases, the AWS Kinesis Data Firehose console reports HTTP 401 or “Access denied” errors for the delivery stream, even though the TLS/SSL handshake appears successful.

Environment

  • Product: Cribl Stream (including Cribl.Cloud deployments)
  • Deployment type: Managed AWS
  • Source type: Amazon Data Firehose (Kinesis Data Firehose HTTP endpoint)
  • Destination: Cribl Stream HTTP endpoint (for example, https://default.main.<your-org-id>.cribl.cloud:443)
  • Authentication: Auth Token(s) configured on the Amazon Data Firehose source in Cribl Stream; Access key configured on the Kinesis Data Firehose HTTP endpoint destination

Resolution

  1. Confirm the error in Cribl Stream worker logs.

    1. From the Cribl Stream leader, go to Monitoring → Worker → Logs (or open the worker’s cribl.log file directly).

    2. Filter for the Firehose source ID (for example, input:<your-firehose-source-id>).

    3. Confirm entries where message is failed to process request and response.errorMessage is Access denied.

    If the response object shows errorMessage: "Access denied", the TLS handshake is succeeding and the failure is occurring at the application/authentication layer, not at SSL/TLS.

  2. Validate Auth Token configuration in Cribl Stream.

    1. In the Cribl UI, navigate to Products → Cribl Stream → Worker Groups and select the affected worker group.

    2. Go to Data → Sources and open the Amazon Data Firehose source used by the Kinesis delivery stream.

    3. Under Authentication, locate the Auth Token(s) (authTokens array in the source config).

    4. Copy one of the active token values; this must exactly match what AWS Kinesis Data Firehose sends in the X-Amz-Firehose-Access-Key header.

  3. Align the Kinesis Data Firehose HTTP endpoint Access key with the Cribl Auth Token.

    1. In the AWS console, open Amazon Kinesis Data Firehose and select the affected delivery stream.

    2. Choose Configuration → Destination settings → HTTP endpoint.

    3. In Access key, paste a token that exactly matches one of the Auth Tokens configured on the Cribl Firehose source (same characters, case, and no leading/trailing spaces).

    4. If you are using AWS Secrets Manager for the access key, ensure the secret’s value resolves to the raw token string expected by Cribl Stream, not an entire JSON object. For example, configure the secret so Firehose sends only the token, not a wrapped JSON payload.

    5. Save the delivery stream configuration.

  4. Enable TLS on the Cribl AWS Firehose source
    Private key path: /opt/criblcerts/criblcloud.key
    Certificate path: /opt/criblcerts/criblcloud.crt

  5. (Optional, non‑production) Temporarily disable authentication to isolate the issue.

    1. In a non‑production environment only, edit the Amazon Data Firehose source in Cribl Stream.

    2. Clear the Auth Token(s) list so the source allows unauthenticated access.

    3. Commit and deploy the change to the worker group.

    4. Retry sending data from the Kinesis Data Firehose delivery stream.

    If events now arrive successfully and the Access denied errors disappear from cribl.log, the issue is confirmed to be an auth token mismatch. Re‑enable authentication by generating a new token in Cribl Stream and updating the Firehose HTTP endpoint Access key to match.

  6. Verify data flow end‑to‑end.

    1. In Cribl Stream, open the Amazon Data Firehose source and use Live Data (or an equivalent capture) to confirm that new events are arriving.

    2. In Amazon Kinesis Data Firehose metrics, confirm that DeliveryToHttpEndpoint.Success is greater than zero for the affected delivery stream.

    3. Verify that downstream routes, pipelines, and destinations are processing the events as expected.

Cause

This can be caused by:

  • TLS was not enabled from Cribl AWS Firehose source since in Cribl Cloud, the AWS Firehose is configured to send to <https://default.main.<organizationId>.cribl.cloud
  • A mismatch between the Access key configured on the Amazon Kinesis Data Firehose HTTP endpoint destination and any Auth Token configured on the corresponding Amazon Data Firehose source in Cribl Stream (including differences in case, trailing spaces, or truncated values).
  • An AWS Secrets Manager secret whose value causes Firehose to send a JSON object or unexpected string instead of the raw token expected by Cribl Stream.
  • Leaving Auth Token(s) configured on the Cribl Firehose source while clearing or changing the HTTP endpoint Access key in AWS so that Firehose sends no valid token for Cribl to match.

Additional Information

Terms & ConditionsAccessibility statement