Setting Up Amazon Marketing Stream V2: By Hand, or By AI

There are two ways to do this and they lead to the same place. The command generator fills your region, dataset and account IDs into every command, and it also writes a prompt carrying those same values that you can hand to Claude or ChatGPT. If you would rather drive, the six steps below are what the generator emits, explained.

Pick by what you want afterwards. If this pipeline is going to be yours to operate, read the traps section even if you let an AI do the typing — they are the part that costs a day, and they are not in the error messages.

Three things have to be true, and none of them are on the tool page:

1. Amazon Ads API credentials that already work

   An LWA client ID and an access token for the advertiser account. Prove they work before you create a single AWS resource — a credential problem discovered at the subscription step looks exactly like a destination problem.

2. Your advertiser account ID

   The amzn1.ads-account.g.… form. In V2 this goes in the request body, under accessRequestedAccounts. There is no scope header, which is the first thing that trips anyone who has used the Ads API before.

3. An AWS account, in a region your realm allows

   Stream delivers into your own AWS account; there is no hosted option. NA is us-east-1 only. EU allows eu-west-1, eu-west-2 and eu-south-2. FE allows us-west-2 and ap-southeast-1. The bucket and the queue must sit in the same one.

eu-south-2 needs enabling in your AWS account before it will take a stack. That is an AWS account setting, not a Stream one, and the failure arrives as a generic CloudFormation error.

Open the command generator, fill in the seven fields on the left, and press Copy the prompt. You get a prompt with your realm, region, dataset, destination name and account IDs already in it, plus the operating rules that matter when a model is running AWS commands on your behalf.

Three of those rules are doing real work, and they are worth knowing even if you never read the prompt:

• Never invent an ARN. Every bucket ARN, queue ARN and queue URL is read out of the CloudFormation stack outputs. A model asked to subscribe before the stack exists will happily construct an ARN that looks right, and Amazon will accept the subscription against a bucket you do not own.
• Ignore everything you remember about Stream. Almost all the Marketing Stream material in a model's training data is V1: Firehose, IAM roles, CAPABILITY_NAMED_IAM, delta records. V2 shares the name and almost nothing else. Without this line you get a confident V1 setup.
• One step at a time, show the real output. The checks only work if somebody looks at the responses, and a model running six commands in a row will summarise them as "done".

1. Get Amazon's template

   StreamV2_S3_CF_Template.yaml from the ads-advanced-tools-docs repo. It creates the bucket, the notification queue, a dead-letter queue, two customer-managed KMS keys and access logging, and attaches the policies that let Amazon write. Doing it by hand is possible and is mostly a way to get a policy subtly wrong.

2. Deploy it

   Two parameters: DestinationName (3–24 characters, lowercase letters, numbers and hyphens) and StreamRealm (NA, EU or FE). One stack per client application, not per dataset. No --capabilities flag — the template creates no IAM roles at all, which is the cleanest single difference from V1.

3. Read the stack outputs

   StreamDataBucketArn and StreamDestinationQueueArn are what the subscription needs. StreamDataBucketName and StreamDestinationQueueUrl are what the verification needs. Take all four now rather than reconstructing them later.

4. Create the subscription

   POST /adsApi/v1/create/streamSubscriptions, one subscription per request, advertiser account in the body. The two ARNs go in destination.s3Destination.

5. Check the response arrays

   Not the status code. See below — this is the step that quietly loses subscriptions.

6. Prove data is landing, then alarm on it stopping

   List the bucket. Read a message off the queue. Then put a CloudWatch alarm on the queue's NumberOfMessagesSent before you walk away.

Everything above is typing. This is the part that decides whether you have a pipeline.

1. The endpoint answers 207 whether it worked or not

Subscription creation returns Multi-Status 207. A rejected subscription — BAD_REQUEST for an invalid destination, FORBIDDEN if you are not authorised for that advertiser account — arrives inside errors[] under that same 207. Any client written as if status == 200 treats a rejection as a success, and you find out weeks later when somebody asks where the data is.

Read success[] and errors[]. Never the status line.

2. ACTIVE does not mean data is flowing

A new subscription comes back ACTIVE straight away. Amazon validates that your bucket and queue are reachable at the moment you subscribe, and then nothing after. A bucket policy missing s3:PutObject leaves you ACTIVE with an empty bucket and no error anywhere — Amazon's own V2 documentation now says as much.

The only proof is objects in S3.

3. Records are restated totals, not deltas

V1 sent deltas you added up. V2 sends the total for a record's time window, and re-sends that record with a higher version when the number changes. A loader that appends, or that sums the versions, inflates every figure it reports. Upsert on the highest version per record key.

This is the one that does not announce itself. The pipeline looks perfect; the numbers are just wrong.

4. Silence is the failure mode

A stalled stream does not publish a zero. It publishes nothing, so the metric has no datapoints, so a default CloudWatch alarm sits in INSUFFICIENT_DATA for ever and you are exactly as blind as you were before you built it. --treat-missing-data breaching is the flag that turns the alarm into an actual alarm.

Build it on day one. The whole reason you need it is that nothing else will tell you.

Two at the moment, both available in all three realms:

Start with ads-performance-v1. It is hourly, so it tells you fastest whether delivery actually works — and a setup you cannot verify quickly is a setup you will debug slowly.

One subscription per request, so two datasets means two calls against the same destination.

• Marketing Stream V2 command generator — the commands and the AI prompt, filled in with your settings
• What V2 changes if you built on V1 — transport, dedupe, account ID and schema, and the order to cut over in
• Amazon: Marketing Stream V2 get started
• amzn/ads-advanced-tools-docs — the CloudFormation template

Written October 2026 against Amazon's V2 documentation and the template as published. Where this guide states a response shape or a parameter name, it was read off the template or the docs on 10 October 2026, not from memory.