AWS
Certified
Tasks and triggers that integrate Amazon Web Services with Kestra workflows, spanning storage (S3, DynamoDB), analytics (Athena, EMR, Glue), messaging and streaming (SNS, SQS, Kinesis, MSK, EventBridge), compute (Lambda, CLI), infrastructure (CloudFormation, ECR), monitoring (CloudWatch), authentication (EKS tokens), AI (Bedrock), and healthcare data (HealthLake).

Authenticate every task and trigger with static credentials (`accessKeyId` and `secretKeyId`, optionally a `sessionToken`), by assuming an IAM role through `stsRoleArn`, or by relying on the default AWS credentials provider chain when none are set. Set `region` for the target service, and override `endpointOverride` with `compatibilityMode` enabled to reach S3-compatible storage backends.

AWS HealthLake

Tasks to manage Amazon HealthLake FHIR R4 data stores and orchestrate bulk import and export jobs as part of healthcare data pipelines.

AWS S3

Tasks that manage Amazon Simple Storage Service (S3) buckets and objects.

AWS EFS

Tasks for managing Amazon EFS file systems and mount targets.

AWS SNS

Tasks that publish notifications to Amazon Simple Notification Service (SNS) topics for pub/sub fanout or SMS, email, Lambda, and SQS targets, with support for custom message attributes.

AWS CloudFormation

Tasks that create, update, or delete AWS CloudFormation stacks and optionally wait for stack operations to finish, returning stack outputs for downstream use.

AWS Authentication

Tasks that generate authentication material for AWS services, such as short-lived tokens to access Amazon EKS clusters.

AWS Eventbridge

Tasks that put events on Amazon EventBridge buses with custom detail payloads so routing rules can fan them out to downstream AWS or SaaS targets.

AWS SQS

Tasks that publish to or consume from Amazon Simple Queue Service (SQS), including polling and real-time triggers.

AWS ECR

Tasks that fetch an Amazon ECR authorization token for Docker or OCI registry logins, useful before building or pulling images in workflows.

AWS Bedrock

Tasks that invoke foundation models on Amazon Bedrock, run structured multi-turn conversations via the unified Converse API, stream responses, and list available models — all using the same AWS credentials as the rest of your plugin-aws stack.

AWS Glue

Tasks that control AWS Glue jobs: start runs with arguments, monitor their status, stop executions, and fetch job metadata to orchestrate serverless Spark ETL pipelines.

AWS EMR

Tasks that orchestrate Amazon EMR and EMR Serverless workloads: create or delete clusters, submit steps, start job runs, and optionally wait for completion so Spark or Hadoop pipelines can be managed from Kestra.

AWS Kinesis

Tasks that write batches of records to Amazon Kinesis Data Streams with partition keys for high-throughput, real-time ingestion pipelines.

AWS Athena

Tasks that run Amazon Athena SQL queries against data in S3 or federated sources, writing results to an S3 output location and optionally fetching rows.

AWS DynamoDB

Tasks that read and write Amazon DynamoDB tables: put, get, or delete individual items and run query or scan operations with expression attributes.

AWS Lambda

Tasks that invoke AWS Lambda functions with optional JSON payloads, capture response bodies or logs, and emit metrics about execution time and payload size for serverless workflows.

AWS CLI

Tasks that run AWS CLI commands (inside a container by default), reuse Kestra credentials and environment variables, and capture stdout or files produced by the CLI.

AWS MSK

Tasks to manage Amazon MSK (Managed Streaming for Apache Kafka) cluster lifecycle and retrieve bootstrap broker connection strings for use with plugin-kafka.

AWS CloudWatch

Tasks that push custom metrics, query recent CloudWatch metric statistics, and trigger flows when metric queries return data.

How to use the AWS plugin

Authenticate with task-level credentials or let the default credentials provider chain discover them from the environment.

Authentication

All tasks must be authenticated for the AWS Platform.

You can either set up the credentials in the task or let the default credentials provider chain search for credentials.

To set up the credentials in the task, you can use:

The accessKeyId and secretKeyId properties for using the static credential provider
The sessionToken property in conjunction with accessKeyId and secretKeyId for temporal credentials
Or the stsRoleArn, stsRoleExternalId and stsRoleSessionName properties for STS assume role credentials

When defining credentials in the task, it is best practice to use secrets.

The default credentials provider chain looks for credentials in this order:

Java System Properties - aws.accessKeyId and aws.secretAccessKey
Environment Variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
Web Identity Token credentials from system properties or environment variables
Credential profiles file at the default location (~/.aws/credentials)
Amazon EC2 container service credentials via AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
Instance profile credentials from the Amazon EC2 metadata service

Common properties

Set region on each task or globally using plugin defaults to avoid repeating it. Most tasks also accept endpointOverride for connecting to custom or locally hosted endpoints such as LocalStack.

Tasks

Tasks span the most commonly used AWS services. The s3 package covers uploads, downloads, copies, deletions, and file-arrival triggers. For messaging and streaming, sqs and sns handle queue consumption and publishing while kinesis covers high-throughput record streaming; both SQS and Kinesis offer a polling Trigger (one execution per batch) and a RealtimeTrigger (one execution per record) — use Trigger for controlled throughput and RealtimeTrigger for low-latency processing.

For data and compute, athena queries S3 data with SQL, glue manages ETL jobs, emr runs Spark and Hadoop workloads, and lambda invokes serverless functions. dynamodb covers key-value reads and writes, cloudwatch handles metrics and log querying, and eventbridge publishes events to an event bus. Use cli.AwsCLI for any operation not covered by a dedicated task.

For AI workloads, bedrock provides direct access to Amazon Bedrock foundation models: InvokeModel sends raw payloads to any model, Converse and ConverseStream use the unified Converse API for model-agnostic multi-turn chat, and ListFoundationModels discovers available models in your region.

For FHIR healthcare workloads, healthlake integrates with Amazon HealthLake: CreateDatastore, DescribeDatastore, ListDatastores, and DeleteDatastore manage FHIR R4 data stores, while StartImportJob, DescribeImportJob, StartExportJob, and DescribeExportJob orchestrate bulk FHIR data movement from and to S3. A Trigger fires flows when import or export jobs reach a terminal state.

For managed Kafka workloads, msk integrates with Amazon MSK: CreateCluster, DescribeCluster, ListClusters, and DeleteCluster manage cluster lifecycle, GetBootstrapBrokers retrieves broker connection strings to pass directly to plugin-kafka tasks, and a Trigger fires flows when a cluster reaches a target state such as ACTIVE.