Back to Apache Flink
Q4Question 4 of 33

What is the difference between Kinesis Data Analytics (managed Flink) and Amazon Kinesis Analytics (SQL-only), and when do you use each

Key Concepts
  • Managed Flink runs full Apache Flink applications with the complete stateful, event-time feature set.
  • SQL-only Kinesis Analytics offers simple streaming SQL with limited windowing, state, and extensibility.
  • The SQL-only service is a legacy path; AWS steers new workloads toward managed Flink.
  • Managed Flink supports DataStream API, Table API, Flink SQL, CEP, and rich connectors.
  • Managed Flink itself supports Flink SQL, so you get SQL-style logic with the full engine underneath.
  • Outgrowing the SQL-only service means a rewrite, so starting on managed Flink avoids future rework.
  • Choose SQL-only only for very simple, low-stakes transforms where its constraints are acceptable.

Definition

Managed Flink runs full Apache Flink applications with the complete stateful, event-time feature set for complex production processing, while the legacy SQL-only Kinesis Analytics offers quick streaming SQL with limited windowing and state.
  • Managed Flink – Runs full Apache Flink applications in Java, Scala, Python, or Flink SQL with the complete feature set.
  • SQL-only Kinesis Analytics – A legacy service for simple streaming SQL directly against Kinesis streams, with limited capabilities.
  • Feature gap – SQL-only lacks robust state management, event-time handling, complex joins, CEP, and rich connectors.
  • Strategic direction – AWS steers new workloads toward managed Flink and encourages migration from SQL-only.
  • Flink SQL on managed Flink – Gives SQL-style logic without the ceiling, making the SQL-only service largely redundant.

The National Bank of India has two tools for analyzing transaction streams. The SQL-only service is like a basic calculator on the counter: an analyst can type a quick sum and get an answer instantly, but it cannot do anything elaborate. Managed Flink is like a full engineering workshop: it can build any machine the bank needs, with memory of each customer, precise timers, and complex pattern detection. For a quick tally the calculator is fine, but for the real fraud engine the bank needs the workshop.

Understanding the Concepts

The managed Flink offering is the full Apache Flink runtime as a managed service. You write real Flink applications and get the entire model.

JAVA
package com.bank.flink.aws;

import org.apache.flink.streaming.api.environment.StreamExecutionEnvironment;
import org.apache.flink.streaming.api.CheckpointingMode;

public class ManagedFlinkFullFeature {
    public static void main(String[] args) throws Exception {
        StreamExecutionEnvironment env = StreamExecutionEnvironment.getExecutionEnvironment();
        env.setParallelism(4);
        env.enableCheckpointing(60000, CheckpointingMode.EXACTLY_ONCE);

        // Full Flink feature set available:
        // - Event-time windows with watermarks
        // - Keyed state with RocksDB
        // - Timers and process functions
        // - CEP and MATCH_RECOGNIZE
        // - Flink SQL and Table API
        // - Rich connector ecosystem
        // - Exactly-once end-to-end

        env.fromElements("fraud-check-001")
            .map(check -> "Scored: " + check)
            .print();
        env.execute("NBI-Full-Feature-Managed");
    }
}
TEXT
Managed Flink capabilities:
  ✓ DataStream API (Java, Scala, Python)
  ✓ Table API and Flink SQL
  ✓ Event-time processing with watermarks
  ✓ Keyed state (HashMap, RocksDB)
  ✓ Event-time and processing-time timers
  ✓ CEP library and MATCH_RECOGNIZE
  ✓ Temporal joins, windowed joins
  ✓ Async I/O
  ✓ Rich connectors (Kinesis, MSK, S3, JDBC, DynamoDB)
  ✓ Exactly-once with compatible sinks
  ✓ Elastic scaling with KPU autoscaling

What is the SQL-only service?

The SQL-only Kinesis Analytics is a simpler service where you write streaming SQL directly against Kinesis streams without any Flink code.

SQL
-- SQL-only Kinesis Analytics example:
-- Simple tumbling window aggregate on a Kinesis stream
CREATE OR REPLACE STREAM output_stream (
    branch_id VARCHAR(32),
    total_amount DOUBLE,
    window_end TIMESTAMP
);

CREATE OR REPLACE PUMP output_pump AS
INSERT INTO output_stream
SELECT STREAM
    branch_id,
    SUM(amount) AS total_amount,
    STEP(transactions.ROWTIME BY INTERVAL '1' MINUTE) AS window_end
FROM transactions
GROUP BY branch_id, STEP(transactions.ROWTIME BY INTERVAL '1' MINUTE);
TEXT
SQL-only limitations:
  ✗ No keyed state or RocksDB
  ✗ No event-time watermarks (processing time only)
  ✗ No complex joins or temporal joins
  ✗ No CEP or MATCH_RECOGNIZE
  ✗ No custom logic or UDFs
  ✗ Limited windowing (tumbling only, basic)
  ✗ No exactly-once guarantees
  ✗ Legacy path (AWS discourages new use)

How do they compare?

| Feature | Managed Flink | SQL-Only |
|---|---|---|
| Programming model | Java/Scala/Python/SQL | SQL only |
| Engine | Apache Flink | Proprietary |
| State management | Full (keyed, RocksDB) | Very limited |
| Event-time processing | Full (watermarks) | Processing time only |
| Complex joins | Temporal, windowed, interval | Basic |
| Pattern detection | CEP, MATCH_RECOGNIZE | None |
| Connectors | Rich ecosystem | Kinesis only |
| Exactly-once | Yes (with compatible sinks) | No |
| Scaling | KPU autoscaling | Limited |
| Portability | Code runs on open-source Flink | Locked in |
| AWS recommendation | Strategic choice | Legacy |

Choose managed Flink for any production workload that is stateful, event-time sensitive, needs complex logic, or is expected to grow.

JAVA
package com.bank.flink.aws;

import org.apache.flink.table.api.EnvironmentSettings;
import org.apache.flink.table.api.TableEnvironment;

public class ManagedFlinkSqlDemo {
    public static void main(String[] args) {
        // Even SQL-style logic runs on managed Flink
        // with the full engine underneath
        TableEnvironment tEnv = TableEnvironment.create(
            EnvironmentSettings.inStreamingMode());

        tEnv.executeSql(
            "SELECT account_id, SUM(amount) " +
            "FROM transactions " +
            "GROUP BY account_id"
        );
        // Full Flink SQL: temporal joins, MATCH_RECOGNIZE,
        // CDC, watermarks, state TTL all available
    }
}

When is the SQL-only service acceptable?

Choose SQL-only only for very simple, low-stakes transformations where its constraints do not bite and the team wants the absolute minimum setup.

TEXT
Acceptable SQL-only use cases:
  - Simple filter: route high-value transactions to an alert stream
  - Basic count: count events per minute for a dashboard
  - Quick prototype: test an idea before building a real pipeline

Not acceptable:
  - Fraud detection (needs state, patterns, exactly-once)
  - CDC synchronization (needs changelog semantics)
  - Financial aggregation (needs event-time correctness)
  - Anything production-critical and long-lived

Outgrowing the SQL-only service means a complete rewrite because the programming models are incompatible. Starting on managed Flink, even with Flink SQL, gives you room to grow.

DIAGRAM
Growth path:
  SQL-only service → need more features → REWRITE to Flink
  Managed Flink (SQL) → need more features → add DataStream code
                                              (same engine, no rewrite)

Managed Flink + Flink SQL gives you:
  - SQL simplicity for simple queries
  - Full engine underneath when you need temporal joins, CEP, etc.
  - No rewrite required as requirements grow

What is the migration path?

AWS encourages migration from SQL-only to managed Flink. The path involves rewriting the SQL into Flink SQL or DataStream code.

TEXT
Migration steps:
  1. Identify SQL-only queries and their input/output streams
  2. Rewrite as Flink SQL (often 1:1 translation for simple queries)
  3. Add watermarks, state TTL, and proper sink configuration
  4. Deploy on managed Flink
  5. Validate output matches the old SQL-only results
  6. Decommission the SQL-only application

What should a senior engineer know?

  • Default new, production-bound work to managed Flink, even when it starts simple.
  • Managed Flink supports Flink SQL, so you can still write SQL without the SQL-only service.
  • The SQL-only service's simplicity is real but shallow; its weak state and event-time handling make it unsuitable for correctness-sensitive processing.
  • Consider cost: managed Flink uses KPU pricing, SQL-only uses a similar model, but managed Flink gives far more capability per unit.
  • Keep skills portable by writing standard Flink code that runs on both managed and self-managed clusters.
JAVA
// Senior tip: use Flink SQL on managed Flink
// Gets the SQL simplicity the team wants
// Plus the full engine: temporal joins, CDC, CEP, exactly-once
// No ceiling, no rewrite risk

Visual Overview

DIAGRAM
  Managed Flink vs SQL-Only – Capability Comparison

  Managed Flink:                   SQL-Only (Legacy):
  ┌────────────────────────┐      ┌────────────────────────┐
  │ Full Apache Flink       │      │ Proprietary SQL engine  │
  │                         │      │                         │
  │ ✓ DataStream API        │      │ ✗ No DataStream         │
  │ ✓ Flink SQL + Table API │      │ ✓ Basic streaming SQL   │
  │ ✓ Event-time + watermarks│     │ ✗ Processing time only  │
  │ ✓ Keyed state (RocksDB) │      │ ✗ No real state mgmt    │
  │ ✓ CEP + MATCH_RECOGNIZE │      │ ✗ No pattern detection  │
  │ ✓ Temporal joins        │      │ ✗ No temporal joins     │
  │ ✓ Exactly-once          │      │ ✗ No exactly-once       │
  │ ✓ Rich connectors       │      │ ✗ Kinesis only          │
  │ ✓ Portable code         │      │ ✗ Locked in             │
  └────────────────────────┘      └────────────────────────┘
   Strategic choice                 Legacy path
DIAGRAM
  Growth Path Decision

  Simple query today → may grow tomorrow

  Option A: Start on SQL-only
    Simple query ──▶ Need more ──▶ REWRITE to Flink ← expensive

  Option B: Start on Managed Flink (with Flink SQL)
    Simple query ──▶ Need more ──▶ Add features ← no rewrite
    (same engine)                  (temporal joins, CEP, etc.)

Key Takeaway

The two AWS offerings differ in power and programming model. Managed Flink runs full Apache Flink applications with the complete feature set: event-time processing, keyed state, CEP, temporal joins, Flink SQL, and exactly-once guarantees. The SQL-only Kinesis Analytics is a legacy service with limited windowing, no real state management, and no event-time handling, suitable only for very simple transforms.

Choose managed Flink for any production workload that is stateful, event-time sensitive, or expected to grow. Managed Flink itself supports Flink SQL, so you get SQL simplicity without the ceiling, making the SQL-only service largely redundant. Outgrowing SQL-only means a complete rewrite, while growing on managed Flink is incremental.

At the National Bank of India, a quick filter routing high-value transactions to an alert stream was acceptable on SQL-only. But the real fraud engine needed per-account state, event-time windows, pattern detection, and exactly-once guarantees, so we built it on managed Flink. We defaulted all new production work to managed Flink, even when it started simple, precisely because growth would otherwise force a rewrite.

Remember one sentence: default to managed Flink for anything production-bound because it gives you the full engine with SQL simplicity, while the SQL-only service is a legacy convenience whose weak state and event-time handling make it unsuitable for correctness-sensitive work.

---

Share
Use ← → arrow keys to navigate