aws-cdk-lib 2.178.2__py3-none-any.whl → 2.180.0__py3-none-any.whl

aws_cdk/aws_kinesis/__init__.py

@@ -17,7 +17,10 @@ intake and aggregation.
     * [Write Permissions](#write-permissions)
     * [Custom Permissions](#custom-permissions)
   * [Metrics](#metrics)
-  * [Resource Policy](#resource-policy)
+* [Stream Consumers](#stream-consumers)
+
+  * [Read Permissions](#read-permissions-1)
+* [Resource Policy](#resource-policy)
 
 ## Streams
 
@@ -186,9 +189,54 @@ stream.metric_get_records_success()
 stream.metric_get_records_success(statistic="Maximum")
 ```
 
-### Resource Policy
+## Stream Consumers
+
+Creating stream consumers allow consumers to receive data from the stream using enhanced fan-out at a rate of up to 2 MiB per second for every shard.
+This rate is unaffected by the total number of consumers that read from the same stream.
+
+For more information, see [Develop enhanced fan-out consumers with dedicated throughput](https://docs.aws.amazon.com/streams/latest/dev/enhanced-consumers.html).
+
+To create and associate a stream consumer with a stream
+
+```python
+stream = kinesis.Stream(self, "MyStream")
+
+stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+    stream_consumer_name="MyStreamConsumer",
+    stream=stream
+)
+```
+
+#### Read Permissions
+
+Grant `read` access to a stream consumer, and the stream it is registered with, by calling the `grantRead()` API.
+
+```python
+lambda_role = iam.Role(self, "Role",
+    assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
+    description="Example role..."
+)
+
+stream = kinesis.Stream(self, "MyEncryptedStream",
+    encryption=kinesis.StreamEncryption.KMS
+)
+stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+    stream_consumer_name="MyStreamConsumer",
+    stream=stream
+)
+
+# give lambda permissions to read stream via the stream consumer
+stream_consumer.grant_read(lambda_role)
+```
+
+In addition to stream's permissions, the following permissions are provided to a service principal by the `grantRead()` API:
+
+* `kinesis:DescribeStreamConsumer`,
+* `kinesis:SubscribeToShard`,
 
-You can create a resource policy for a data stream.
+## Resource Policy
+
+You can create a resource policy for a data stream or a stream consumer.
 For more information, see [Controlling access to Amazon Kinesis Data Streams resources using IAM](https://docs.aws.amazon.com/streams/latest/dev/controlling-access.html).
 
 A resource policy is automatically created when `addToResourcePolicy` is called, if one doesn't already exist.
@@ -197,13 +245,24 @@ Using `addToResourcePolicy` is the simplest way to add a resource policy:
 
 ```python
 stream = kinesis.Stream(self, "MyStream")
+stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+    stream_consumer_name="MyStreamConsumer",
+    stream=stream
+)
 
-# create a resource policy via addToResourcePolicy method
+# create a stream resource policy via addToResourcePolicy method
 stream.add_to_resource_policy(iam.PolicyStatement(
     resources=[stream.stream_arn],
     actions=["kinesis:GetRecords"],
     principals=[iam.AnyPrincipal()]
 ))
+
+# create a stream consumer resource policy via addToResourcePolicy method
+stream_consumer.add_to_resource_policy(iam.PolicyStatement(
+    resources=[stream.stream_arn],
+    actions=["kinesis:DescribeStreamConsumer"],
+    principals=[iam.AnyPrincipal()]
+))
 ```
 
 You can create a resource manually by using `ResourcePolicy`.
@@ -212,6 +271,10 @@ If not, a blank policy document will be set.
 
 ```python
 stream = kinesis.Stream(self, "MyStream")
+stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+    stream_consumer_name="MyStreamConsumer",
+    stream=stream
+)
 
 # create a custom policy document
 policy_document = iam.PolicyDocument(
@@ -225,11 +288,17 @@ policy_document = iam.PolicyDocument(
     ]
 )
 
-# create a resource policy manually
+# create a stream resource policy manually
 kinesis.ResourcePolicy(self, "ResourcePolicy",
     stream=stream,
     policy_document=policy_document
 )
+
+# create a stream consumer resource policy manually
+kinesis.ResourcePolicy(self, "ResourcePolicy",
+    stream_consumer=stream_consumer,
+    policy_document=policy_document
+)
 ```
 '''
 from pkgutil import extend_path
@@ -3089,6 +3158,158 @@ class _IStreamProxy(
 typing.cast(typing.Any, IStream).__jsii_proxy_class__ = lambda : _IStreamProxy
 
 
+@jsii.interface(jsii_type="aws-cdk-lib.aws_kinesis.IStreamConsumer")
+class IStreamConsumer(_IResource_c80c4260, typing_extensions.Protocol):
+    '''A Kinesis Stream Consumer.'''
+
+    @builtins.property
+    @jsii.member(jsii_name="stream")
+    def stream(self) -> IStream:
+        '''The stream associated with this consumer.
+
+        :attribute: true
+        '''
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="streamConsumerArn")
+    def stream_consumer_arn(self) -> builtins.str:
+        '''The ARN of the stream consumer.
+
+        :attribute: true
+        '''
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="streamConsumerName")
+    def stream_consumer_name(self) -> builtins.str:
+        '''The name of the stream consumer.
+
+        :attribute: true
+        '''
+        ...
+
+    @jsii.member(jsii_name="addToResourcePolicy")
+    def add_to_resource_policy(
+        self,
+        statement: _PolicyStatement_0fe33853,
+    ) -> _AddToResourcePolicyResult_1d0a53ad:
+        '''Adds a statement to the IAM resource policy associated with this stream consumer.
+
+        If this stream consumer was created in this stack (``new StreamConsumer``), a resource policy
+        will be automatically created upon the first call to ``addToResourcePolicy``. If
+        the stream consumer is imported (``StreamConsumer.from``), then this is a no-op.
+
+        :param statement: -
+        '''
+        ...
+
+    @jsii.member(jsii_name="grant")
+    def grant(
+        self,
+        grantee: _IGrantable_71c4f5de,
+        *actions: builtins.str,
+    ) -> _Grant_a7ae64f8:
+        '''Grant the indicated permissions on this stream consumer to the provided IAM principal.
+
+        :param grantee: -
+        :param actions: -
+        '''
+        ...
+
+    @jsii.member(jsii_name="grantRead")
+    def grant_read(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant read permissions for this stream consumer and its associated stream to an IAM principal (Role/Group/User).
+
+        :param grantee: -
+        '''
+        ...
+
+
+class _IStreamConsumerProxy(
+    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
+):
+    '''A Kinesis Stream Consumer.'''
+
+    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_kinesis.IStreamConsumer"
+
+    @builtins.property
+    @jsii.member(jsii_name="stream")
+    def stream(self) -> IStream:
+        '''The stream associated with this consumer.
+
+        :attribute: true
+        '''
+        return typing.cast(IStream, jsii.get(self, "stream"))
+
+    @builtins.property
+    @jsii.member(jsii_name="streamConsumerArn")
+    def stream_consumer_arn(self) -> builtins.str:
+        '''The ARN of the stream consumer.
+
+        :attribute: true
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "streamConsumerArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="streamConsumerName")
+    def stream_consumer_name(self) -> builtins.str:
+        '''The name of the stream consumer.
+
+        :attribute: true
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "streamConsumerName"))
+
+    @jsii.member(jsii_name="addToResourcePolicy")
+    def add_to_resource_policy(
+        self,
+        statement: _PolicyStatement_0fe33853,
+    ) -> _AddToResourcePolicyResult_1d0a53ad:
+        '''Adds a statement to the IAM resource policy associated with this stream consumer.
+
+        If this stream consumer was created in this stack (``new StreamConsumer``), a resource policy
+        will be automatically created upon the first call to ``addToResourcePolicy``. If
+        the stream consumer is imported (``StreamConsumer.from``), then this is a no-op.
+
+        :param statement: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__37c37a05c26ce89345f11707cf8d0c79c7d0abfdb26093c52bdf5503d8f1d7d3)
+            check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
+        return typing.cast(_AddToResourcePolicyResult_1d0a53ad, jsii.invoke(self, "addToResourcePolicy", [statement]))
+
+    @jsii.member(jsii_name="grant")
+    def grant(
+        self,
+        grantee: _IGrantable_71c4f5de,
+        *actions: builtins.str,
+    ) -> _Grant_a7ae64f8:
+        '''Grant the indicated permissions on this stream consumer to the provided IAM principal.
+
+        :param grantee: -
+        :param actions: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__cf3550b30daa1ef048e2fefa63cc0765dc59458fde35eb1301476a6b6c3ac2e9)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+            check_type(argname="argument actions", value=actions, expected_type=typing.Tuple[type_hints["actions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grant", [grantee, *actions]))
+
+    @jsii.member(jsii_name="grantRead")
+    def grant_read(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant read permissions for this stream consumer and its associated stream to an IAM principal (Role/Group/User).
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__ce58f2c46edcaa40f59d7e5fc1f893d206283c930800a7814a6a4e0636aa7638)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantRead", [grantee]))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IStreamConsumer).__jsii_proxy_class__ = lambda : _IStreamConsumerProxy
+
+
 class ResourcePolicy(
     _Resource_45bc6135,
     metaclass=jsii.JSIIMeta,
@@ -3112,6 +3333,10 @@ class ResourcePolicy(
     Example::
 
         stream = kinesis.Stream(self, "MyStream")
+        stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+            stream_consumer_name="MyStreamConsumer",
+            stream=stream
+        )
         
         # create a custom policy document
         policy_document = iam.PolicyDocument(
@@ -3125,11 +3350,17 @@ class ResourcePolicy(
             ]
         )
         
-        # create a resource policy manually
+        # create a stream resource policy manually
         kinesis.ResourcePolicy(self, "ResourcePolicy",
             stream=stream,
             policy_document=policy_document
         )
+        
+        # create a stream consumer resource policy manually
+        kinesis.ResourcePolicy(self, "ResourcePolicy",
+            stream_consumer=stream_consumer,
+            policy_document=policy_document
+        )
     '''
 
     def __init__(
@@ -3137,20 +3368,26 @@ class ResourcePolicy(
         scope: _constructs_77d1e7e8.Construct,
         id: builtins.str,
         *,
-        stream: IStream,
         policy_document: typing.Optional[_PolicyDocument_3ac34393] = None,
+        stream: typing.Optional[IStream] = None,
+        stream_consumer: typing.Optional[IStreamConsumer] = None,
     ) -> None:
         '''
         :param scope: -
         :param id: -
-        :param stream: The stream this policy applies to.
         :param policy_document: IAM policy document to apply to a data stream. Default: - empty policy document
+        :param stream: The stream this policy applies to. Note: only one of ``stream`` and ``streamConsumer`` must be set. Default: - policy is not associated to a stream
+        :param stream_consumer: The stream consumer this policy applies to. Note: only one of ``stream`` and ``streamConsumer`` must be set. Default: - policy is not associated to a consumer
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__4488fc34b1387c696011cd138108f10e13139cd2d56365a8ba9602ad6ba244f0)
             check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
-        props = ResourcePolicyProps(stream=stream, policy_document=policy_document)
+        props = ResourcePolicyProps(
+            policy_document=policy_document,
+            stream=stream,
+            stream_consumer=stream_consumer,
+        )
 
         jsii.create(self.__class__, self, [scope, id, props])
 
@@ -3164,25 +3401,35 @@ class ResourcePolicy(
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_kinesis.ResourcePolicyProps",
     jsii_struct_bases=[],
-    name_mapping={"stream": "stream", "policy_document": "policyDocument"},
+    name_mapping={
+        "policy_document": "policyDocument",
+        "stream": "stream",
+        "stream_consumer": "streamConsumer",
+    },
 )
 class ResourcePolicyProps:
     def __init__(
         self,
         *,
-        stream: IStream,
         policy_document: typing.Optional[_PolicyDocument_3ac34393] = None,
+        stream: typing.Optional[IStream] = None,
+        stream_consumer: typing.Optional[IStreamConsumer] = None,
     ) -> None:
         '''Properties to associate a data stream with a policy.
 
-        :param stream: The stream this policy applies to.
         :param policy_document: IAM policy document to apply to a data stream. Default: - empty policy document
+        :param stream: The stream this policy applies to. Note: only one of ``stream`` and ``streamConsumer`` must be set. Default: - policy is not associated to a stream
+        :param stream_consumer: The stream consumer this policy applies to. Note: only one of ``stream`` and ``streamConsumer`` must be set. Default: - policy is not associated to a consumer
 
         :exampleMetadata: infused
 
         Example::
 
             stream = kinesis.Stream(self, "MyStream")
+            stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+                stream_consumer_name="MyStreamConsumer",
+                stream=stream
+            )
             
             # create a custom policy document
             policy_document = iam.PolicyDocument(
@@ -3196,28 +3443,30 @@ class ResourcePolicyProps:
                 ]
             )
             
-            # create a resource policy manually
+            # create a stream resource policy manually
             kinesis.ResourcePolicy(self, "ResourcePolicy",
                 stream=stream,
                 policy_document=policy_document
             )
+            
+            # create a stream consumer resource policy manually
+            kinesis.ResourcePolicy(self, "ResourcePolicy",
+                stream_consumer=stream_consumer,
+                policy_document=policy_document
+            )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b4f61add9bc5e3d367f841a39ff9a752c7eed270f05849d0b5f9dc5e5ad3382a)
-            check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
             check_type(argname="argument policy_document", value=policy_document, expected_type=type_hints["policy_document"])
-        self._values: typing.Dict[builtins.str, typing.Any] = {
-            "stream": stream,
-        }
+            check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
+            check_type(argname="argument stream_consumer", value=stream_consumer, expected_type=type_hints["stream_consumer"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
         if policy_document is not None:
             self._values["policy_document"] = policy_document
-
-    @builtins.property
-    def stream(self) -> IStream:
-        '''The stream this policy applies to.'''
-        result = self._values.get("stream")
-        assert result is not None, "Required property 'stream' is missing"
-        return typing.cast(IStream, result)
+        if stream is not None:
+            self._values["stream"] = stream
+        if stream_consumer is not None:
+            self._values["stream_consumer"] = stream_consumer
 
     @builtins.property
     def policy_document(self) -> typing.Optional[_PolicyDocument_3ac34393]:
@@ -3228,6 +3477,28 @@ class ResourcePolicyProps:
         result = self._values.get("policy_document")
         return typing.cast(typing.Optional[_PolicyDocument_3ac34393], result)
 
+    @builtins.property
+    def stream(self) -> typing.Optional[IStream]:
+        '''The stream this policy applies to.
+
+        Note: only one of ``stream`` and ``streamConsumer`` must be set.
+
+        :default: - policy is not associated to a stream
+        '''
+        result = self._values.get("stream")
+        return typing.cast(typing.Optional[IStream], result)
+
+    @builtins.property
+    def stream_consumer(self) -> typing.Optional[IStreamConsumer]:
+        '''The stream consumer this policy applies to.
+
+        Note: only one of ``stream`` and ``streamConsumer`` must be set.
+
+        :default: - policy is not associated to a consumer
+        '''
+        result = self._values.get("stream_consumer")
+        return typing.cast(typing.Optional[IStreamConsumer], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -3254,12 +3525,17 @@ class Stream(
 
     Example::
 
-        key = kms.Key(self, "MyKey")
+        lambda_role = iam.Role(self, "Role",
+            assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
+            description="Example role..."
+        )
         
-        kinesis.Stream(self, "MyEncryptedStream",
-            encryption=kinesis.StreamEncryption.KMS,
-            encryption_key=key
+        stream = kinesis.Stream(self, "MyEncryptedStream",
+            encryption=kinesis.StreamEncryption.KMS
         )
+        
+        # give lambda permissions to read stream
+        stream.grant_read(lambda_role)
     '''
 
     def __init__(
@@ -3355,7 +3631,7 @@ class Stream(
     ) -> _AddToResourcePolicyResult_1d0a53ad:
         '''Adds a statement to the IAM resource policy associated with this stream.
 
-        If this stream was created in this stack (``new Strem``), a resource policy
+        If this stream was created in this stack (``new Stream``), a resource policy
         will be automatically created upon the first call to ``addToResourcePolicy``. If
         the stream is imported (``Stream.import``), then this is a no-op.
 
@@ -4468,6 +4744,293 @@ class StreamAttributes:
         )
 
 
+@jsii.implements(IStreamConsumer)
+class StreamConsumer(
+    _Resource_45bc6135,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_kinesis.StreamConsumer",
+):
+    '''A Kinesis Stream Consumer.
+
+    :exampleMetadata: infused
+
+    Example::
+
+        lambda_role = iam.Role(self, "Role",
+            assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
+            description="Example role..."
+        )
+        
+        stream = kinesis.Stream(self, "MyEncryptedStream",
+            encryption=kinesis.StreamEncryption.KMS
+        )
+        stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+            stream_consumer_name="MyStreamConsumer",
+            stream=stream
+        )
+        
+        # give lambda permissions to read stream via the stream consumer
+        stream_consumer.grant_read(lambda_role)
+    '''
+
+    def __init__(
+        self,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        stream: IStream,
+        stream_consumer_name: builtins.str,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param stream: The Kinesis data stream to associate this consumer with.
+        :param stream_consumer_name: The name of the stream consumer.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__92f5f01a78ec0e2889ff9d24638f94bc34cb2e1cb6e828df5ba3bd88446ef982)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = StreamConsumerProps(
+            stream=stream, stream_consumer_name=stream_consumer_name
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @jsii.member(jsii_name="fromStreamConsumerArn")
+    @builtins.classmethod
+    def from_stream_consumer_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        stream_consumer_arn: builtins.str,
+    ) -> IStreamConsumer:
+        '''Imports an existing Kinesis Stream Consumer by its arn.
+
+        :param scope: the Construct scope.
+        :param id: the ID of the construct.
+        :param stream_consumer_arn: the arn of the existing stream consumer.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__5f0b7b629c1bc39d17d380fd07a1480ffe6bd762ae9db4936b106fe46cafc6aa)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument stream_consumer_arn", value=stream_consumer_arn, expected_type=type_hints["stream_consumer_arn"])
+        return typing.cast(IStreamConsumer, jsii.sinvoke(cls, "fromStreamConsumerArn", [scope, id, stream_consumer_arn]))
+
+    @jsii.member(jsii_name="fromStreamConsumerAttributes")
+    @builtins.classmethod
+    def from_stream_consumer_attributes(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        stream_consumer_arn: builtins.str,
+    ) -> IStreamConsumer:
+        '''Imports an existing Kinesis Stream Consumer by its attributes.
+
+        :param scope: the Construct scope.
+        :param id: the ID of the construct.
+        :param stream_consumer_arn: The Amazon Resource Name (ARN) of the stream consumer.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f17e059f4c9c80a17ccaf154600fcef4fb1d6913f82f8c94fa23e8d4ba96b253)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        attrs = StreamConsumerAttributes(stream_consumer_arn=stream_consumer_arn)
+
+        return typing.cast(IStreamConsumer, jsii.sinvoke(cls, "fromStreamConsumerAttributes", [scope, id, attrs]))
+
+    @jsii.member(jsii_name="addToResourcePolicy")
+    def add_to_resource_policy(
+        self,
+        statement: _PolicyStatement_0fe33853,
+    ) -> _AddToResourcePolicyResult_1d0a53ad:
+        '''Adds a statement to the IAM resource policy associated with this stream consumer.
+
+        If this stream consumer was created in this stack (``new StreamConsumer``), a resource policy
+        will be automatically created upon the first call to ``addToResourcePolicy``. If
+        the stream is imported (``StreamConsumer.from``), then this is a no-op.
+
+        :param statement: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__106f9684fefb675b40f61d28d1dda945ae52717ea3b5e7e128cfc0199ddead44)
+            check_type(argname="argument statement", value=statement, expected_type=type_hints["statement"])
+        return typing.cast(_AddToResourcePolicyResult_1d0a53ad, jsii.invoke(self, "addToResourcePolicy", [statement]))
+
+    @jsii.member(jsii_name="grant")
+    def grant(
+        self,
+        grantee: _IGrantable_71c4f5de,
+        *actions: builtins.str,
+    ) -> _Grant_a7ae64f8:
+        '''Grant the indicated permissions on this stream consumer to the given IAM principal (Role/Group/User).
+
+        :param grantee: -
+        :param actions: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__ea5ac90fc600673df96ac4c0dfcc78a85073a04b78101720e951e1ad1275947a)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+            check_type(argname="argument actions", value=actions, expected_type=typing.Tuple[type_hints["actions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grant", [grantee, *actions]))
+
+    @jsii.member(jsii_name="grantRead")
+    def grant_read(self, grantee: _IGrantable_71c4f5de) -> _Grant_a7ae64f8:
+        '''Grant read permissions for this stream consumer and its associated stream to an IAM principal (Role/Group/User).
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__21b7fc951011e7e3fc14b6da5ab3310f7cb75cec5142637f1f3948367f34ac02)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantRead", [grantee]))
+
+    @builtins.property
+    @jsii.member(jsii_name="autoCreatePolicy")
+    def _auto_create_policy(self) -> builtins.bool:
+        '''Indicates if a resource policy should automatically be created upon the first call to ``addToResourcePolicy``.
+
+        Set by subclasses.
+        '''
+        return typing.cast(builtins.bool, jsii.get(self, "autoCreatePolicy"))
+
+    @builtins.property
+    @jsii.member(jsii_name="stream")
+    def stream(self) -> IStream:
+        '''The Kinesis data stream this consumer is associated with.'''
+        return typing.cast(IStream, jsii.get(self, "stream"))
+
+    @builtins.property
+    @jsii.member(jsii_name="streamConsumerArn")
+    def stream_consumer_arn(self) -> builtins.str:
+        '''The Amazon Resource Name (ARN) of the stream consumer.'''
+        return typing.cast(builtins.str, jsii.get(self, "streamConsumerArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="streamConsumerName")
+    def stream_consumer_name(self) -> builtins.str:
+        '''The name of the stream consumer.'''
+        return typing.cast(builtins.str, jsii.get(self, "streamConsumerName"))
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_kinesis.StreamConsumerAttributes",
+    jsii_struct_bases=[],
+    name_mapping={"stream_consumer_arn": "streamConsumerArn"},
+)
+class StreamConsumerAttributes:
+    def __init__(self, *, stream_consumer_arn: builtins.str) -> None:
+        '''A reference to a StreamConsumer, which can be imported using ``StreamConsumer.fromStreamConsumerAttributes``.
+
+        :param stream_consumer_arn: The Amazon Resource Name (ARN) of the stream consumer.
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_kinesis as kinesis
+            
+            stream_consumer_attributes = kinesis.StreamConsumerAttributes(
+                stream_consumer_arn="streamConsumerArn"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__20c23f144f51a3022c363961c4f41ecf0c94178d27a73de9a47005ed26d27e2f)
+            check_type(argname="argument stream_consumer_arn", value=stream_consumer_arn, expected_type=type_hints["stream_consumer_arn"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "stream_consumer_arn": stream_consumer_arn,
+        }
+
+    @builtins.property
+    def stream_consumer_arn(self) -> builtins.str:
+        '''The Amazon Resource Name (ARN) of the stream consumer.'''
+        result = self._values.get("stream_consumer_arn")
+        assert result is not None, "Required property 'stream_consumer_arn' is missing"
+        return typing.cast(builtins.str, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "StreamConsumerAttributes(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_kinesis.StreamConsumerProps",
+    jsii_struct_bases=[],
+    name_mapping={"stream": "stream", "stream_consumer_name": "streamConsumerName"},
+)
+class StreamConsumerProps:
+    def __init__(self, *, stream: IStream, stream_consumer_name: builtins.str) -> None:
+        '''Properties for a Kinesis Stream Consumer.
+
+        :param stream: The Kinesis data stream to associate this consumer with.
+        :param stream_consumer_name: The name of the stream consumer.
+
+        :exampleMetadata: infused
+
+        Example::
+
+            lambda_role = iam.Role(self, "Role",
+                assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
+                description="Example role..."
+            )
+            
+            stream = kinesis.Stream(self, "MyEncryptedStream",
+                encryption=kinesis.StreamEncryption.KMS
+            )
+            stream_consumer = kinesis.StreamConsumer(self, "MyStreamConsumer",
+                stream_consumer_name="MyStreamConsumer",
+                stream=stream
+            )
+            
+            # give lambda permissions to read stream via the stream consumer
+            stream_consumer.grant_read(lambda_role)
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9f73c02253aa03618517236d4d9c34ae8992a4074435af984a475dc83cc0adf8)
+            check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
+            check_type(argname="argument stream_consumer_name", value=stream_consumer_name, expected_type=type_hints["stream_consumer_name"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "stream": stream,
+            "stream_consumer_name": stream_consumer_name,
+        }
+
+    @builtins.property
+    def stream(self) -> IStream:
+        '''The Kinesis data stream to associate this consumer with.'''
+        result = self._values.get("stream")
+        assert result is not None, "Required property 'stream' is missing"
+        return typing.cast(IStream, result)
+
+    @builtins.property
+    def stream_consumer_name(self) -> builtins.str:
+        '''The name of the stream consumer.'''
+        result = self._values.get("stream_consumer_name")
+        assert result is not None, "Required property 'stream_consumer_name' is missing"
+        return typing.cast(builtins.str, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "StreamConsumerProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
 @jsii.enum(jsii_type="aws-cdk-lib.aws_kinesis.StreamEncryption")
 class StreamEncryption(enum.Enum):
     '''What kind of server-side encryption to apply to this stream.
@@ -4476,12 +5039,17 @@ class StreamEncryption(enum.Enum):
 
     Example::
 
-        key = kms.Key(self, "MyKey")
+        lambda_role = iam.Role(self, "Role",
+            assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
+            description="Example role..."
+        )
         
-        kinesis.Stream(self, "MyEncryptedStream",
-            encryption=kinesis.StreamEncryption.KMS,
-            encryption_key=key
+        stream = kinesis.Stream(self, "MyEncryptedStream",
+            encryption=kinesis.StreamEncryption.KMS
         )
+        
+        # give lambda permissions to read stream
+        stream.grant_read(lambda_role)
     '''
 
     UNENCRYPTED = "UNENCRYPTED"
@@ -4682,10 +5250,14 @@ __all__ = [
     "CfnStreamConsumerProps",
     "CfnStreamProps",
     "IStream",
+    "IStreamConsumer",
     "ResourcePolicy",
     "ResourcePolicyProps",
     "Stream",
     "StreamAttributes",
+    "StreamConsumer",
+    "StreamConsumerAttributes",
+    "StreamConsumerProps",
     "StreamEncryption",
     "StreamMode",
     "StreamProps",
@@ -4914,20 +5486,41 @@ def _typecheckingstub__bd578f4ca8facd0463f7e56d3d2cea7e56ba9ad274338af8f84fa661d
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__37c37a05c26ce89345f11707cf8d0c79c7d0abfdb26093c52bdf5503d8f1d7d3(
+    statement: _PolicyStatement_0fe33853,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__cf3550b30daa1ef048e2fefa63cc0765dc59458fde35eb1301476a6b6c3ac2e9(
+    grantee: _IGrantable_71c4f5de,
+    *actions: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__ce58f2c46edcaa40f59d7e5fc1f893d206283c930800a7814a6a4e0636aa7638(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__4488fc34b1387c696011cd138108f10e13139cd2d56365a8ba9602ad6ba244f0(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,
     *,
-    stream: IStream,
     policy_document: typing.Optional[_PolicyDocument_3ac34393] = None,
+    stream: typing.Optional[IStream] = None,
+    stream_consumer: typing.Optional[IStreamConsumer] = None,
 ) -> None:
     """Type checking stubs"""
     pass
 
 def _typecheckingstub__b4f61add9bc5e3d367f841a39ff9a752c7eed270f05849d0b5f9dc5e5ad3382a(
     *,
-    stream: IStream,
     policy_document: typing.Optional[_PolicyDocument_3ac34393] = None,
+    stream: typing.Optional[IStream] = None,
+    stream_consumer: typing.Optional[IStreamConsumer] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -5021,6 +5614,67 @@ def _typecheckingstub__91a6150e079b5a451763b8bb3f2235aa5c667a527f0d1c95510199368
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__92f5f01a78ec0e2889ff9d24638f94bc34cb2e1cb6e828df5ba3bd88446ef982(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    stream: IStream,
+    stream_consumer_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__5f0b7b629c1bc39d17d380fd07a1480ffe6bd762ae9db4936b106fe46cafc6aa(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    stream_consumer_arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__f17e059f4c9c80a17ccaf154600fcef4fb1d6913f82f8c94fa23e8d4ba96b253(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    stream_consumer_arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__106f9684fefb675b40f61d28d1dda945ae52717ea3b5e7e128cfc0199ddead44(
+    statement: _PolicyStatement_0fe33853,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__ea5ac90fc600673df96ac4c0dfcc78a85073a04b78101720e951e1ad1275947a(
+    grantee: _IGrantable_71c4f5de,
+    *actions: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__21b7fc951011e7e3fc14b6da5ab3310f7cb75cec5142637f1f3948367f34ac02(
+    grantee: _IGrantable_71c4f5de,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__20c23f144f51a3022c363961c4f41ecf0c94178d27a73de9a47005ed26d27e2f(
+    *,
+    stream_consumer_arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__9f73c02253aa03618517236d4d9c34ae8992a4074435af984a475dc83cc0adf8(
+    *,
+    stream: IStream,
+    stream_consumer_name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__88629f78086711b76f550ae13e14f2db1429deb350aa5b10b7073d5852dadfcc(
     *,
     encryption: typing.Optional[StreamEncryption] = None,