Amazon AppFlow

What it is

Amazon AppFlow is a fully managed service that moves data between software as a service (SaaS) applications, such as Salesforce, SAP, ServiceNow, Slack, or Zendesk, and AWS services, such as Amazon S3 and Amazon Redshift, with no code. You configure a flow in the console: where the data comes from, where it goes, when it runs, and how fields are mapped and filtered. AppFlow then runs it.

For example, a flow can copy new Salesforce opportunities into Amazon Redshift every hour, or pull Zendesk support tickets into an S3 Data lakeA central store for large amounts of structured and unstructured data kept in its original form, usually in Amazon S3, which many tools can analyze. AWS Lake Formation helps build and secure one.Glossary entry for analysis.

Flows

A flow has a source, a destination, a trigger, and mappings.

Sources and destinations

AppFlow has connectors for dozens of SaaS applications, plus AWS services such as Amazon S3, Amazon Redshift, and Amazon EventBridge. Data can also flow from AWS back to some SaaS applications, for example from S3 into Salesforce. For applications without a built-in connector, the Custom Connector SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry lets you build your own, including for private API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry systems.

When the destination is Amazon S3, you choose the file format (JSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entry Lines, CSV, or Apache ParquetAn open-source columnar file format for analytics that stores compressed columns along with the schema. Querying Parquet files with Amazon Athena scans less data than CSV or JSON, so it is faster and cheaper.Glossary entry), how files are partitioned and aggregated, and whether to register the data in the AWS Glue Data Catalog, so that Athena and other analytics services can query it right away.

Triggers

Trigger	When the flow runs
On demand	When a user runs it
On schedule	On a recurring schedule, as often as once a minute if the source allows it. Choose a full transfer (all records) or an incremental transfer (only records added or changed since the last run)
On event	When the source application reports a change event, for SaaS applications that support them, such as Salesforce

AppFlow can also publish Salesforce events to an EventBridge partner event bus, where rules route them to Lambda, Step Functions, SQS, and other targets.

Mapping, filtering, and validating

Field mapping maps source fields to destination fields, by hand or from a CSV file.
Transformations concatenate fields, and mask or truncate values, for example to hide part of a phone number.
Filters transfer only the records that match conditions.
Validations check fields for bad data, and set the action AppFlow takes when a record has a bad field.

Security, resilience, performance, and cost

Security

Connection credentials, such as OAuth tokens, API keys, and passwords, are encrypted with AWS KMS and stored in AWS Secrets Manager.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry: while a flow runs, AppFlow stores the data temporarily in an intermediate S3 bucket, encrypted with a KMS key that you choose (AWS managed or customer managed). When S3 is the destination, the files are encrypted with SSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entry-KMS.
Encryption in transitEncrypting data while it moves across a network, usually with TLS, so that it cannot be read or changed on the way.Glossary entry is protected with TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry 1.2.
Private flows: for SaaS applications integrated with AWS PrivateLink, such as Salesforce and Snowflake, the data travels over AWS infrastructure and never crosses the public internet. The SaaS account must be enabled for PrivateLink.
IAM controls who can create and run flows and use each connection.

Resilience and performance

A flow run can last up to 48 hours. AppFlow handles the transfer and its retries; you do not manage servers or scaling.
Each SaaS application has its own limits, such as data per flow run or how often a schedule can run, and AppFlow's API calls count against the SaaS application's API limits. Large transfers may need several flows with filters.
If a scheduled or event-triggered flow keeps failing, AppFlow deactivates it and publishes an event, so set up a rule to alert you.

Cost

You pay per successful flow run, plus per GB of data processed. Scheduled runs that find no new data still count as runs.
S3 storage and requests, and KMS keys, are charged separately.

Monitoring

Amazon EventBridge receives an event when a flow run starts and ends (with the number of records processed and failed), and when AppFlow deactivates a flow.
The flow's run history in the console shows each run's status and data volume.
AWS CloudTrail records AppFlow API calls.

AppFlow or another service?

If the requirement is	Choose
Copy data from Salesforce, Zendesk, or another SaaS app into S3 or Redshift, with no code	Amazon AppFlow
Transfer SaaS data without crossing the public internet	AppFlow private flow over PrivateLink
Transform and join data with custom ETL (Extract, transform, and load)Copying data from sources, cleaning and reshaping it, and loading it into a target such as a data warehouse. AWS Glue is the AWS serverless ETL service.Glossary entry jobs	AWS Glue
React in real time to SaaS events	EventBridge partner event bus (AppFlow can feed it for Salesforce)
Move files from on-premises storage to AWS	AWS DataSync
Subscribe to third-party data sets	AWS Data Exchange

Reverse mindmap: when the question points here

Is it Amazon AppFlow?

Yes, when the question says
- Transfer Salesforce data to S3 or Redshift with no code leads to Amazon AppFlow
- Sync SaaS application data on a schedule leads to Scheduled flow
- Copy only new or changed records each run leads to Incremental transfer
- Run when a record changes in Salesforce leads to Event-triggered flow
Shape the data
- Mask sensitive fields before they land leads to Mask values in the field mapping
- Make the data queryable by Athena leads to Register it in the Glue Data Catalog
- Store the data in a columnar format leads to Parquet output to S3
Secure it
- Data must not cross the public internet leads to Private flow with PrivateLink
- Encrypt with your own key leads to Customer managed KMS key
No, when the question says
- Complex ETL across many data sources leads to AWS Glue
- Move on-premises files to S3 leads to AWS DataSync
- Coordinate several processing steps leads to AWS Step Functions

Key takeaways

AppFlow moves data between SaaS applications and AWS services, with no code and no servers.
Flows run on demand, on a schedule (full or incremental), or on events from the SaaS application.
Field mapping, masking, filters, and validations shape the data; S3 destinations can use Parquet and the Glue Data Catalog.
Credentials live in Secrets Manager, data is encrypted with KMS, and private flows use PrivateLink.
You pay per successful flow run plus per GB processed; EventBridge events report each run.