Integrating Amazon Data Firehose with NordStellar

This guide walks you through connecting NordStellar to Amazon Data Firehose (formerly Amazon Kinesis Data Firehose). Once connected, NordStellar streams alert findings such as leaked credentials, malware infections, dark web mentions, and attack surface vulnerabilities into your Firehose delivery stream. From there, Firehose delivers them to whatever destination the stream is configured for — Amazon S3, OpenSearch, Redshift, Snowflake, Splunk, or a custom HTTP endpoint — so the data lands directly in your own AWS data pipeline.

How the Integration Works

Unlike integrations that authenticate with an API key, this integration stores no credentials at all. Instead, you create an IAM role in your own AWS account that NordStellar is allowed to assume:

1. NordStellar shows you a Launch stack link that opens AWS CloudFormation with everything pre-filled. The stack creates an IAM role whose trust policy allows only NordStellar's AWS principal — and only when it presents an External ID unique to your organization — and whose permissions allow writing to your delivery stream.
2. You tell NordStellar the AWS account ID you created the role in, plus the region and delivery stream name events should go to.
3. For every delivery, NordStellar assumes the role to obtain short-lived credentials and writes the findings to your stream.

You can revoke NordStellar's access at any time by deleting the role (or the CloudFormation stack) in your AWS account — there is no key to rotate on either side.

Prerequisites

Before you begin, make sure you have:

• An AWS account and a user or role that can create CloudFormation stacks and IAM roles in it.
• An existing Amazon Data Firehose delivery stream in the account and region you want findings delivered to, with its destination already configured. NordStellar writes to the stream; the stream's own configuration determines where the data ends up.
• Your 12-digit AWS account ID at hand — it is shown in the AWS console's account menu.
• Organization Admin permissions in NordStellar.

Step 1: Create the IAM Role in AWS

NordStellar opens the connection wizard with everything needed to create the role.

Step 2: Enter the Connection Details

Tell NordStellar where to deliver events.

Step 3: Configure and Connect

Choose what to forward, then verify the connection end to end.

Step 4: Verify Data Is Arriving

The test event is delivered immediately, but Amazon Data Firehose buffers incoming records before flushing them to the destination, so allow for the stream's buffer interval (up to a few minutes with default settings) before checking.

For example, with an S3 destination:

1. Open the destination bucket in the AWS console.
2. Look for a new object under the stream's prefix.
3. The object contains one JSON record per line — the test event carries a title and description confirming the connection.

Real findings arrive the same way as they are detected. Each record is a structured JSON object with the finding type, risk level, affected asset, and detection time.

Security Model

• No stored secrets. NordStellar keeps only the role ARN, region, and stream name. Authentication happens through AWS STS role assumption with short-lived credentials.
• External ID. The role's trust policy requires an External ID that is unique to your NordStellar organization and generated by NordStellar. This prevents any other party — including other NordStellar customers — from asking NordStellar to assume your role (the confused deputy problem (opens in a new tab)).
• Least privilege. The role created by the CloudFormation stack can write to your delivery stream and nothing else.
• Revocable by you. Deleting the role or the stack in your AWS account cuts off NordStellar's access immediately.

Troubleshooting

If connecting fails or findings are not appearing, review the following:

• "Could not assume the IAM role":

  • Confirm the CloudFormation stack reached CREATE_COMPLETE before you clicked Connect.
  • Confirm the AWS account ID you entered is the account the stack was created in.
  • If you set the role up manually, confirm the role name matches the name shown under Set up manually instead exactly, that the trust policy requires the shown External ID, and that it trusts the shown NordStellar principal ARN.
  • Confirm the role or stack has not been deleted or modified since it was created.

• The test write failed:

  • Confirm the region matches where the delivery stream actually lives — a stream name only resolves within its region.
  • Confirm the delivery stream name is spelled exactly as in AWS, and that the stream exists and is in the Active state.
  • Confirm the role's permissions still allow writing to this stream, particularly if you pointed the integration at a different stream than the role was created for.

• Connected, but no data at the destination:

  • Allow for the stream's buffering interval — Firehose flushes to the destination in batches.
  • Check the delivery stream's monitoring tab in the AWS console for delivery errors; a failing destination (for example, a deleted S3 bucket or a failing OpenSearch cluster) is reported there, not in NordStellar.
  • Confirm the integration applies to the projects whose findings you expect to see.
  • If you enabled Send existing events, verify the selected date range includes the findings you are checking.

• Records look merged together at the destination:

  • Each finding is a single line of JSON terminated by a newline. Configure your consumer to parse newline-delimited JSON rather than expecting one JSON document per S3 object.

If you've checked these details and the problem persists, please contact NordStellar support for assistance.