All three sit in the same AWS streaming family and all three show up in Domain 1 of the DEA-C01, but they solve three different problems. Kinesis Data Streams buffers and replays, Amazon Data Firehose delivers, and Managed Service for Apache Flink processes state. Knowing which one a scenario needs is the actual skill being tested.
Last updated July 2026.
| Kinesis Data Streams | Amazon Data Firehose | Managed Flink | |
|---|---|---|---|
| Core job | Durable, ordered, replayable buffer | Delivers data to a destination | Stateful stream processing |
| Data retention | 24 hours default, up to 365 days | None; no relationship after delivery | Depends on the app's state and checkpoints |
| Consumers | Multiple independent consumers | None, delivery is the endpoint | Reads from streams like Kinesis or MSK |
| Latency | Sub-second | Seconds to minutes (buffered) | Sub-second, in-flight |
| Pricing model | Per shard-hour or per GB (on-demand) | Per GB ingested and delivered | Per Kinesis Processing Unit (KPU) |
Retention figures from the Kinesis Data Streams developer guide.
Multiple independent applications need to read the same stream, you need to replay data from up to a year back, or you need sub-second latency with fine-grained control over sharding and scaling. Data Streams is a durable buffer, not a destination: something still has to read from it and do something with the records.
The destination is S3, Redshift, OpenSearch Service, Splunk, Snowflake, or another supported target, and the job is reliable delivery without managing consumers or scaling. Firehose supports light transformation through an attached Lambda function, but once it delivers a record, the service has no further relationship with that data. Reprocessing means reading it back out of wherever it landed, not replaying it from Firehose itself.
The workload needs windowed aggregations, stream-to-stream joins, exactly-once stateful processing, or anything that has to remember what it saw earlier. Fraud detection, recommendation engines, and real-time ETL that transforms and enriches records before they land are the typical cases. This is the only one of the three that runs your own application logic against the stream rather than moving or delivering data as-is.
A frequent production pattern uses Kinesis Data Streams as the durable entry point, with Managed Service for Apache Flink reading from it as one consumer to do stateful processing, and Amazon Data Firehose reading from it as a separate consumer to land a copy of the raw or processed records into S3 for durable, zero-maintenance archival. This combines low-latency processing with reliable storage without any one service trying to do all three jobs at once.
Domain 1 (Data Ingestion and Transformation) is the largest domain on the exam at 34% of scored questions, and it explicitly lists Kinesis Data Streams for streaming ingestion alongside Amazon MSK. Amazon Data Firehose and Managed Service for Apache Flink both fall inside the same domain's transformation and pipeline task statements. A scenario question that names a specific need (replay, plain delivery, or stateful processing) is almost always testing whether you can tell these three apart, not testing service syntax.
Kinesis Data Streams is a durable buffer you read from, with data replayable for up to 365 days and support for multiple independent consumers. Amazon Data Firehose delivers data to a destination and has no further relationship with it once delivered; there is no replay from Firehose itself.
Yes. A common pattern uses Kinesis Data Streams as the durable source with Firehose as one of several consumers, delivering a copy of the stream into S3 or another destination.
The exam guide lists Managed Service for Apache Flink as an in-scope streaming service under Domain 1. Exam questions test when to choose it over the alternatives, not Flink application code itself.
24 hours by default, extendable up to 8,760 hours (365 days) using the IncreaseStreamRetentionPeriod operation, with additional charges for retention above the default.
Amazon Data Firehose and Managed Service for Apache Flink both carry renamed identities. If the old names are throwing you off in practice material, the rename explainer covers exactly what changed and what did not.
Read the rename explainer →