Amazon DataFirehose HTTP method

Based on the troubleshooting guidance for Amazon Data Firehose HTTP endpoints, here are some recommendations to help diagnose your issue:

Troubleshooting Steps:

1. Check CloudWatch Logs: Ensure that the IAM role associated with your Firehose delivery stream has permissions to write to CloudWatch Logs. Data Firehose logs delivery attempts, response codes, and error messages to CloudWatch, which is essential for identifying where failures occur. Without proper CloudWatch logging permissions, you won't see error logs even when deliveries are failing.

2. Verify IAM Role Permissions: Confirm that your Firehose IAM role has access to:

• The S3 backup bucket (for failed deliveries)
• CloudWatch log group and log streams
• Any Lambda functions if data transformation is enabled

3. Review HTTP Response Codes: When Firehose successfully connects to your endpoint but doesn't receive a 200 response code, it logs the response code and truncated payload to CloudWatch. Common issues include:

• 400 errors: Misconfiguration of URL, common attributes, content encoding, access key, or buffering hints
• 401 errors: Incorrect or missing access key
• 403 errors: Access key lacks permissions to deliver to the endpoint
• 413 errors: Request payload too large - try lowering buffering hints
• 429 errors: Too many requests - increase buffering time and/or size

4. Check Buffering Configuration: Since test data works but production doesn't, the volume or size of Security Hub findings might be triggering buffering thresholds differently. Review your buffering hints to ensure they align with Cribl's requirements.

5. Validate Endpoint Response Format: Firehose expects responses to conform to specific specifications, including proper RequestId, timestamps, Content-Type headers, and JSON format. Invalid responses cause delivery failures and retries.

Common Misconfigurations:

The most common issues in this integration pattern are insufficient IAM permissions (particularly for CloudWatch logging), incorrect endpoint configuration, and buffering settings that don't match the destination's capacity limits. The fact that test data succeeds suggests the endpoint configuration is correct, so focus on IAM permissions and CloudWatch logs first to gain visibility into what's happening with production traffic.
Sources
Troubleshooting HTTP Endpoints - Amazon Data Firehose