Kinesis update

Author: marinhero

src/connections/destinations/catalog/amazon-kinesis/index.md

@@ -48,7 +48,7 @@ To get started:
 4. Create a new Kinesis destination.
    1. In the Segment source that you want to connect to your Kinesis destination, click **Add Destination**. Search and select the **Amazon Kinesis** destination.
    2. Enter the **Role Address**, **Stream Region**, **Stream Name**, and **Secret ID**.
-   * **NOTE:** For security purposes, Segment recommends you to use your Workspace ID as your Secret ID. If you’re using a Secret ID different from your Workspace ID, you’re susceptible to attacks. You can find your Workspace ID by going to: **Settings > Workspace Settings > ID**.
+   * **NOTE:** For security purposes, Segment recommends you to use your Workspace ID as your Secret ID. If you’re using a Secret ID different from your Workspace ID, consider changing it. You can find your Workspace ID by going to: **Settings > Workspace Settings > ID**.
 
 ## Page
 If you're not familiar with the Segment Specs, take a look to understand what the [Page method](https://segment.com/docs/connections/spec/page/) does. An example call would look like:
@@ -213,11 +213,11 @@ The Kinesis destination defaults to use PutRecords. A previous version of the IA
    ```
 After you update the IAM policy, Segment systems default to use PutRecords for more efficient data transmission. This is a zero-downtime change and doesn't impact your data other than increasing the deliverability success rate.
 
-### Use a single secret ID
-If you have many sources using Kinesis that it's impractical to attach all of their IDs to your IAM role, you can instead opt to set a single ID to use. To set this value:
+### Use secret ID
+If you have many sources using Kinesis that it's impractical to attach all of their IDs to your IAM role, you can instead opt to set a secret ID. To set this value:
 1. Go to **Connections > Destinations > Amazon Kinesis** for each of your Segment sources.
 2. Click **Secret ID** and enter your Workspace ID.
-    * **NOTE:** For security purposes, Segment recommends you to use your Workspace ID as your Secret ID. If you’re using a Secret ID different from your Workspace ID, you're susceptible to attacks. You can find your Workspace ID by going to:  **Settings > Workspace Settings > ID**.
+    * **NOTE:** For security purposes, Segment recommends you to use your Workspace ID as your Secret ID. If you’re using a Secret ID different from your Workspace ID, consider changing it. You can find your Workspace ID by going to:  **Settings > Workspace Settings > ID**.
 3. Once all of your sources have been updated to use this value, find the IAM role you created for this destination in the AWS Console in **Services > IAM > Roles**.
 4. Click on the role and navigate to the **Trust Relationships** tab.
 5. Click **Edit trust relationship**. You should see a snippet that looks something that looks like this:
@@ -241,4 +241,8 @@ If you have many sources using Kinesis that it's impractical to attach all of th
       ]
     }
     ```
-6. Replace the value of `sts:ExternalId` (`"YOUR_SEGMENT_SOURCE_ID"`) with your Secret ID.
+6. Replace the value of `sts:ExternalId` (`"YOUR_SEGMENT_SOURCE_ID"`) with your Secret ID. In the exceptional case of requiring the use multiple secretIds replace the `sts:ExternalId` setting above with:
+
+   ```
+    "sts:ExternalId": ["A_SECRET_ID", "ANOTHER_SECRET_ID"]
+   ```