Developing Applications On Managed Service For Apache Flink
AWSOfficialPublished by AWS
- Skill
- Tool integration
- Cloud and DevOps
- Apache-2.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
This skill provides domain-specific knowledge for building, deploying, and maintaining Apache Flink applications on Amazon Managed Service for Apache Flink (MSF). It covers service-specific constraints, including the KPU resource model, configuration requirements, and operational lifecycle management. It emphasizes the use of service-level configurations over application-level settings for checkpoints and parallelism, and provides guidance on navigating the v1/v2 API identifier split for AWS CLI and SDK operations.
What it does
- Provides patterns for KPU-based resource configuration and scaling.
- Outlines service-specific constraints for checkpointing and parallelism.
- Details the lifecycle management for starting, stopping, and updating applications.
- Offers guidance on connector integration for Kinesis, Kafka, and Iceberg.
- Explains the v1/v2 identifier differences for IAM, CloudWatch, and SDK usage.
- Provides troubleshooting steps for application restart loops and state management.
When to use it
- When developing or migrating Apache Flink applications for Amazon Managed Service for Apache Flink.
- When configuring KPU resources or troubleshooting application scaling behavior.
- When setting up IAM roles, trust policies, or CloudWatch logging for MSF.
- When performing version upgrades or migrating from Flink 1.x to 2.x.
- When implementing connectors for Kinesis, Kafka, or Iceberg within an MSF environment.
Advantages
- Ensures adherence to MSF-specific service constraints and operational patterns.
- Prevents common configuration errors related to the v1/v2 API identifier split.
- Provides structured workflows for application lifecycle and deployment tasks.
- Offers clear guidance on avoiding anti-patterns in job graph design and resource management.
Usage examples
- “How do I correctly configure checkpoints for an application running on Managed Service for Apache Flink?”
- The agent will advise against hardcoding checkpoint configurations in the application code and instead direct the user to manage these settings via the MSF service-level configuration.
- “I am getting a ConcurrentModificationException when updating my Flink application. How do I fix this?”
- The agent will explain the need to fetch the current application version ID or use a conditional token before issuing an update command, providing the necessary CLI syntax.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/aws/developing-applications-on-managed-service-for-apache-flink/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip developing-applications-on-managed-service-for-apache-flink.zip -d .agents/skills
Documentation by AWS
Managed Service for Apache Flink
Overview
Domain expertise for Apache Flink applications on Amazon Managed Service for Apache Flink (MSF). Covers development, KPU resource management, connectors, state management, monitoring, IaC deployment, and version migration.
Execute commands using available tools from the AWS MCP server when connected — it provides sandboxed execution, audit logging, and observability. When the MCP server is not available, fall back to the AWS CLI or shell as needed.
General Guidance
Before starting, ensure you have a clear understanding of the user persona, use case, and requirements:
STOP: Determine the users background and use case before proceeding:
Are they new to Flink? New to Managed Service for Apache Flink?
Are they familiar with Java development?
Is the use case complex with lots of business logic? Or simple and declarative?
These will inform how to organize the project, and whether to use Flink Table API or DataStream API. In general, assume the DataStream API.
Example Workflow for New Applications
1. User asks to build a Flink application
2. Confirm user's goals and use case
3. READ [best-practices.md](references/best-practices.md)
4. READ [dependency-management.md](references/dependency-management.md)
5. READ relevant connector guides (e.g. [kinesis-connector-guide.md](references/kinesis-connector-guide.md))
6. Generate code following the loaded guidance
7. Validate against best practices
8. READ environment-setup.md via [environment-setup.md](references/environment-setup.md)
9. Compile and test locallyExample Workflow for General Questions
1. User asks about real time delivery of data to Iceberg
2. Confirm user's goals and use case
3. READ [best-practices.md](references/best-practices.md)
4. READ [iceberg-connector-guide.md](references/iceberg-connector-guide.md)
5. READ other reference files as needed
6. Answer question with loaded guidanceReference Files
You MUST use this skill and its reference files to answer any question on these topics.
Do NOT answer from training knowledge or by searching general AWS documentation when the question concerns Apache Flink, Managed Service for Apache Flink, KPU sizing, Flink monitoring, deployment, migration, real-time analytics, or Iceberg/LakeHouse streaming with Flink
You MUST load the relevant reference files below before taking other steps.
The reference files contain MSF-specific details (thresholds, statistics, namespaces, constraints) that differ from generic Flink guidance and are required for correct responses.
| Goal | Reference | When to Load |
|---|---|---|
| Best practices | best-practices.md | Always before writing code |
| Maven dependencies | dependency-management.md | New project or adding connectors |
| Local dev environment | environment-setup.md | Docker-based local development |
| MSF architecture | msf-overview.md | KPU model and service constraints |
| MSF constraints and patterns | msf-constraints-and-patterns.md | MSF vs self-managed Flink, service-level vs application-level configuration separation, MSF-specific resource/network/storage limits, common MSF patterns |
| Quotas, ENI planning, MSF vs EMR, source/sink choice | foundation-operations.md | Capacity planning, service selection, architecture design, CLI/IAM/CloudWatch identifier disambiguation |
| IAM execution role, trust policy, action prefix, service principal | foundation-operations.md | Writing IAM policies for MSF — covers the kinesisanalytics: (no v2) action prefix, kinesisanalytics.amazonaws.com (no v2) trust principal, and the v2/non-v2 disconnect that is the most common source of permission and AssumeRole failures |
| Flink 2.x migration | flink-2x-migration.md | Version upgrades, state compatibility |
| KPU sizing | resource-optimization.md | Right-sizing, performance diagnosis, scaling |
| Scaling decisions on running apps | scaling-decisions.md | In-flight scaling matrix, cost/memory impact of scale changes, autoscaling behavior, anti-patterns |
| Cost estimation | pricing-calculator.md | Budget planning, sizing-to-cost mapping, optimization levers |
| Application lifecycle ops | application-lifecycle.md | Start/stop, deploy code, rollback, snapshot lifecycle, runtime properties, delete |
| Restart loop diagnosis | first-fault-isolation.md | Crashing/restarting apps, finding original failure vs loop sustainers, Flink Dashboard live diagnosis |
| Checkpoint tuning | checkpoint-tuning.md | Checkpoint impact on KPU memory and CPU, frequency vs network bandwidth trade-offs, checkpoint duration exceeding interval, OOM/GC during checkpoints |
| Job graph design | job-graph-architecture.md | Performance issues, splitting jobs |
| Job graph anti-patterns | job-graph-anti-patterns.md | Data skew detection and mitigation, monolith job anti-pattern, high fan-out anti-pattern, removing multiple shuffles, when to split a large application |
| Monitoring and alarms | monitoring-and-metrics.md | CloudWatch dashboards, alarms, metrics |
| Logging | logging-configuration.md | Log4j2, CloudWatch Logs setup |
| Kinesis connectors | kinesis-connector-guide.md | Kinesis source and sink builders, polling configuration and throttling (READER_EMPTY_RECORDS_FETCH_INTERVAL, SHARD_GET_RECORDS_MAX, ReadProvisionedThroughputExceeded, LimitExceededException), legacy connector migration |
| Kinesis Enhanced Fan-Out (EFO) | kinesis-efo-guide.md | When to use EFO vs polling, EFO source configuration, consumer lifecycle (JOB_MANAGED vs SELF_MANAGED), parallelism vs shard count, IAM permissions, troubleshooting |
| Iceberg integration (write APIs, distribution modes, partitioning) | iceberg-connector-guide.md | Iceberg write APIs (append, upsert, dynamic), distribution modes (NONE/HASH/RANGE), CoW vs MoR, read patterns, partitioning, DDL. Does NOT contain catalog choice or maintenance approaches — for those, load iceberg-tuning-and-operations.md. |
| Iceberg tuning, operations, catalog choice, maintenance | iceberg-tuning-and-operations.md | Provides maintenance approaches for S3 Tables, Glue + Glue auto-compaction, and Glue + Flink embedded maintenance with JDBC lock for catalog-choice questions; small files problem and mitigations; Flink TableMaintenance API, post-commit maintenance, lock factories; IcebergSink monitoring, anti-patterns. |
| CDC connectors | cdc-connector-guide.md | MySQL, PostgreSQL, Oracle, SQL Server, MongoDB CDC |
| IaC and deployment | iac-and-deployment.md | CloudFormation, CDK, Terraform, two-phase deployment |
| Serialization | serialization-guide.md | POJO, Avro, Kryo guidance |
| State management | state-management.md | TTL, state types, migration safety |
Additional Resources
Files
- ATTRIBUTION.mdAdded by AutoGineer998 B
- LICENSELicence file added by AutoGineer9.9 KiB
- NOTICELicence file added by AutoGineer67 B
- SKILL.md8.8 KiB
- references/application-lifecycle.md20.7 KiB
- references/best-practices.md11.6 KiB
- references/cdc-connector-guide.md47.2 KiB
- references/checkpoint-tuning.md6.4 KiB
- references/dependency-management.md13.4 KiB
- references/environment-setup.md7.0 KiB
- references/first-fault-isolation.md14.4 KiB
- references/flink-2x-migration.md34.1 KiB
- references/foundation-operations.md12.1 KiB
- references/iac-and-deployment.md17.1 KiB
- references/iceberg-connector-guide.md17.1 KiB
- references/iceberg-tuning-and-operations.md31.1 KiB
- references/job-graph-anti-patterns.md11.8 KiB
- references/job-graph-architecture.md8.9 KiB
- references/kinesis-connector-guide.md9.3 KiB
- references/kinesis-efo-guide.md7.3 KiB
- references/logging-configuration.md9.9 KiB
- references/monitoring-and-metrics.md34.3 KiB
- references/msf-constraints-and-patterns.md8.8 KiB
- references/msf-overview.md6.3 KiB
- references/pricing-calculator.md6.2 KiB
- references/resource-optimization.md9.9 KiB
- references/scaling-decisions.md5.4 KiB
- references/serialization-guide.md9.2 KiB
- references/state-management.md4.5 KiB
references/resource-optimization.md
Resource Optimization Guide
Overview
This guide covers KPU sizing, operator parallelism tuning, Amazon Managed Service for Apache Flink configuration overrides, and checkpoint resource impact. Use it when right-sizing a new Managed Service for Apache Flink application or optimizing an existing one based on CloudWatch metrics.
KPU Sizing Methodology
CRITICAL: Understanding the KPU Resource Model
Each Kinesis Processing Unit (KPU) provides exactly:
1 vCPU
4 GB memory (3 GiB JVM heap + 1 GiB reserved for native code allocations including RocksDB, network buffers, and framework overhead)
50 GB running application storage
Managed Service for Apache Flink allocates KPUs based on two configuration parameters you set at the service level (console or API):
Parallelism: The total number of parallel task slots for your application (default: 1, default max: 256)
ParallelismPerKPU: The number of task slots per KPU (default: 1, max: 8)
MSF derives the KPU count from these settings:
Allocated KPUs = Parallelism / ParallelismPerKPU.
| Parallelism | ParallelismPerKPU | Allocated KPUs | Resources |
|---|---|---|---|
| 4 | 1 | 4 | 4 vCPU, 16 GB |
| 8 | 1 | 8 | 8 vCPU, 32 GB |
| 16 | 2 | 8 | 8 vCPU, 32 GB |
| 16 | 1 | 16 | 16 vCPU, 64 GB |
| 32 | 2 | 16 | 16 vCPU, 64 GB |
| 32 | 1 | 32 | 32 vCPU, 128 GB |
Use ParallelismPerKPU = 1 for most workloads. Increase only when the application is CPU-light and memory-light per task slot (e.g., simple filtering or routing jobs), or for applications with blocking operations (e.g., I/O) where higher values lead to fuller utilization of KPU resources. Higher values pack more task slots per KPU, reducing memory/CPU/storage available per slot.
Estimating Needed KPU Count
Start with the highest of these three estimates, then add headroom:
1. CRITICAL: Throughput-based estimate:
base_kpus = (input_record_rate × avg_record_size_bytes × processing_amplification) / throughput_per_kpuprocessing_amplification: ratio of total bytes processed (including intermediate shuffles) to input bytes. Typically 2–4× for jobs withkeyByand windowing.throughput_per_kpu: start with 5–10 MB/s per KPU for typical ETL workloads. CPU-intensive transformations (regex, JSON parsing, ML inference) reduce this to 1–3 MB/s.
2. CRITICAL: State-size-based estimate:
base_kpus = total_state_size_gb / usable_memory_per_kpu_gbusable_memory_per_kpu_gb: approximately 2–2.5 GB per KPU after JVM overhead and network buffers (out of 3 GiB heap). The 1 GiB native memory is used by RocksDB and framework overhead. With ParallelismPerKPU = 2, usable memory per slot drops to ~1–1.2 GB.
3. CRITICAL: Source-parallelism-based estimate:
base_kpus = max(kinesis_shard_count, kafka_partition_count)Source parallelism should match the partition/shard count. If the source has 16 shards, you generally need at least 16 task slots.
Final KPU count with headroom:
recommended_kpus = max(throughput_estimate, state_estimate, source_estimate) × 1.3The 1.3× multiplier provides ~30% headroom for checkpoint overhead, traffic spikes, and GC pauses. Round up to the nearest even number for balanced TaskManager allocation.
Auto-Scaling Behavior
Managed Service for Apache Flink's built-in auto-scaling uses fixed rules based on containerCPUUtilization:
Scale up: When
containerCPUUtilizationexceeds 75% for 15 consecutive 1-minute datapoints, Managed Service for Apache Flink doublesCurrentParallelism(which increases allocated KPUs).Scale down: When
containerCPUUtilizationstays below 10% for 360 consecutive 1-minute datapoints (6 hours), Managed Service for Apache Flink halvesCurrentParallelism. Will never reduce below the configuredParallelismsetting.During scaling: Application enters
AUTOSCALINGstatus with downtime. OnlyStopApplicationwithForce=trueis valid.Auto-scaling reacts only to CPU, not
heapMemoryUtilizationor backpressure. Scale manually for other metrics.Default KPU limit: 64 per application. Request increase via Service Quotas.
For finer-grained control, disable built-in auto-scaling and implement custom scaling using CloudWatch alarms and the UpdateApplication API.
Using CloudWatch Metrics to Determine Scaling Direction
After deployment, use these CloudWatch metrics to validate sizing and adjust:
| Metric | Scale Up Signal | Scale Down Signal |
|---|---|---|
containerCPUUtilization | Sustained > 75% over 15 min (triggers auto-scale-up) | Sustained < 10% over 6 hours (triggers auto-scale-down) |
heapMemoryUtilization | Sustained > 80% | Sustained < 40% |
backPressuredTimeMsPerSecond | > 100 ms/s sustained | Consistently 0 |
lastCheckpointDuration | Increasing trend, approaching interval | Stable and well below interval |
millisBehindLatest (Kinesis) | Increasing over time | Stable near 0 |
Scaling decision process:
heapMemoryUtilization graduated thresholds:
Healthy: ≤ 75% — no action needed
Scale-up / investigation: > 80% sustained — investigate state size, TTL, and consider adding KPUs (see monitoring-and-metrics.md)
Critical alarm: > 90% — immediate action required; risk of OOM (see checkpoint-tuning.md for OOM diagnostic steps)
High
containerCPUUtilization+ lowheapMemoryUtilization→ add KPUs (CPU-bound)High
heapMemoryUtilization+ low CPU → increase KPUs or request memory override (memory-bound)High
backPressuredTimeMsPerSecond→ identify bottleneck operator, then scale or optimizeGrowing
millisBehindLatest→ add KPUs or optimize processing logic
Operator Parallelism Tuning
When to Override Default Parallelism
Managed Service for Apache Flink sets application-level parallelism through the service console (Parallelism and ParallelismPerKPU parameters). In most cases, all operators inherit the configured Parallelism as their default. Override per-operator parallelism with setParallelism() only when:
A source operator needs parallelism matched to its partition/shard count
A CPU-intensive operator needs higher parallelism than the rest of the pipeline
A lightweight operator (simple filter, static enrichment) can run at lower parallelism to free task slots
Do not set application-level parallelism in code for Managed Service for Apache Flink deployments. Managed Service for Apache Flink service-level settings take precedence.
CRITICAL: Source Parallelism Recommendations
Set source parallelism equal to the number of Kinesis shards or Kafka partitions:
// Kinesis: match shard count
DataStream<Event> events = env
.fromSource(kinesisSource, watermarkStrategy, "kinesis-source")
.setParallelism(16) // Match shard count
.uid("kinesis-source-uid");If parallelism < partition/shard count, some subtasks handle multiple partitions (uneven load). If parallelism > count, excess subtasks sit idle and waste task slots.
Per-Operator Parallelism and KPU Interaction
When you set per-operator parallelism, Managed Service for Apache Flink still allocates task slots based on the maximum parallelism across all operators. Operators with lower parallelism use fewer slots; operators with higher parallelism require enough total slots to accommodate them.
Example: Parallelism = 16, ParallelismPerKPU = 1 → 16 KPUs, 16 task slots.
// Source: 8 shards → parallelism 8
DataStream<Event> events = env
.fromSource(kinesisSource, watermarkStrategy, "kinesis-source")
.setParallelism(8)
.uid("kinesis-source-uid");
// CPU-heavy processing: inherits default parallelism of 16
DataStream<Result> results = events
.keyBy(Event::getKey)
.process(new HeavyProcessor())
.uid("heavy-processor-uid");
results.sinkTo(sink).uid("sink-uid");Managed Service for Apache Flink Configuration Overrides
Parameters Overridable via AWS Support
Managed Service for Apache Flink manages most infrastructure configuration automatically. However, certain parameters can be overridden by opening an AWS support case. These include:
| Parameter | Default | Override Range | Use Case |
|---|---|---|---|
| JVM heap size | 3 GiB (~75% of KPU memory) | Custom | Applications with large in-memory caches or high object churn |
| TaskManager native memory | 1 GiB (~25% of KPU memory) | Custom | Adjusting RocksDB vs heap balance |
| RocksDB block cache size | Auto-configured | Custom size | Large state with frequent random reads |
| RocksDB write buffer count | Default | 2–6 | High write-throughput state workloads |
| Network buffer memory | Auto-configured | Custom size | Jobs with high fan-out or many network channels |
| State backend type (RocksDB vs. HashMap) | RocksDB | Jobs with lightweight state that can stay in-memory and benefit from faster in-memory performance |
Process for Requesting Overrides
Gather diagnostic evidence: CloudWatch metrics showing the resource constraint (heap utilization, GC time, checkpoint duration trends)
Open an AWS support case under "Managed Service for Apache Flink"
Include: application ARN, current KPU count, the specific parameter to override, the requested value, and the diagnostic evidence
AWS support applies the override at the service level — no application code changes needed
After the override is applied, Managed Service for Apache Flink restarts the application to pick up the new configuration
For checkpoint impact on resources (checkpoint size and memory, frequency vs CPU/network, duration exceeding interval, OOM/GC diagnostic steps), see checkpoint-tuning.md.
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- AWS
- Publisher
- AWS (Official)
- Source
- aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/developing-applications-on-managed-service-for-apache-flink · commit 0a218f8
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- NOTICE (added by AutoGineer from NOTICE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- aws/agent-toolkit-for-aws
AutoGineer is not affiliated with or endorsed by AWS.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download developing-applications-on-managed-service-for-apache-flink.zip