We currently use kinesis to receive near real-time event data in json format and load it into s3 and Redshift.
In order to have online triggered complex events based on aggregations, we plan to use wso2 cep, with Storm for scalability.
What is the best practice here? Should storm be the one connected to kinesis?
When you are using WSO2 CEP with Storm scalability you should send events to WSO2 CEP which will publish the events to Storm and get the results back. Basically Storm deployment will be transparent and you will send and receive events via CEP. AFAIU You can send events to WSO2 CEP using desired method via a consumer in Kinesis. CEP supports many receiver types.
You can refer this to understand more about deployment architecture and configurations. This guide explains on how to create an execution plan and deploy in storm. To try out the functionality you can follow this sample.
Regards