JA EN
shiichan

Kinesis Data Streams just dropped its awkward permission-checking hack for a real DryRun!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#devops

Hi everyone, it's me! Today I want to share a nice update for Amazon Kinesis Data Streams that I found!

AWS What's New aws.amazon.com

What was announced?

In the AWS What's New, Amazon Kinesis Data Streams announced support for a new dry run feature. It lets you check whether an API request would succeed without actually executing the operation. You can now set the new optional 'DryRun' parameter to true in your API requests to validate permissions before touching a stream in production.

The story so far

Until now, there was no safe way to test whether an application had the correct permissions to access a stream. Because of that, many people relied on sending a request deliberately engineered to fail after the permission check, such as a PutRecord request with a payload larger than the maximum supported size.

That approach was fragile. If the service's limits ever changed, a request that was supposed to fail could unexpectedly succeed, writing unintended records into the production stream and affecting any downstream consumers.

Previously, customers had no safe way to test whether their application had the correct permissions to access a stream.

What changes

With this update, you can simply set the 'DryRun' parameter to true to safely validate permissions and request inputs, without actually interacting with the stream. No more crafting requests designed to fail, and no more worrying about service limits shifting under you.

Dive Deep

Let's check the mechanics and coverage from the announcement.

  • If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the DryRun parameter
  • The dry run feature is available for five APIs:
    • PutRecord
    • PutRecords
    • GetRecords
    • GetShardIterator
    • SubscribeToShard
  • It's available in all AWS Regions where Amazon Kinesis Data Streams is available
  • More details are covered in "Test your permissions and request inputs with dry run" in the Amazon Kinesis Data Streams Developer Guide

Wrap-up

  • Kinesis Data Streams now supports a DryRun parameter to check whether an API request would succeed, without actually running it
  • Previously, the only option was sending deliberately failing requests to check permissions, which risked writing unintended records if service limits ever changed
  • A successful check returns a DryRunOperationException, confirming the request would have succeeded
  • Five APIs are supported (PutRecord, PutRecords, GetRecords, GetShardIterator, SubscribeToShard) across every Region where Kinesis Data Streams is available

If you're building streaming applications and want to verify permissions safely before going live, or if your team has been relying on that fragile hack, this update should bring some real peace of mind!

Related posts