Hi, I'm Ask INFA!
What would you like to know?
ASK INFAPreview
Please to access Ask INFA.
You were redirected to the closest matching page. If this looks correct, please consider bookmarking it for future reference.
Not Found
English

Page Not Found

The page or file you are looking for has been moved or no longer exists.

The following links might help you find the content you need:


You can also search the Documentation Portal or visit the home page.

English
  • Data Integration Connectors
  • All Products

Table of Contents

Search

  1. Introduction to Amazon S3 V2 Connector
  2. Amazon S3 V2 connections
  3. Amazon S3 V2 sources and targets
  4. Mappings and mapping tasks with Amazon S3 V2
  5. Migrating a mapping
  6. Upgrading to Amazon S3 V2 Connector
  7. Data type reference
  8. Troubleshooting

Amazon S3 V2 Connector

Amazon S3 V2 Connector

Back Next

Temporary security credentials policy

Temporary security credentials policy

To use the temporary security credentials to access the AWS resources, both the IAM user and IAM role require policies.
The following section lists the policies required for the IAM user and IAM role:
IAM user
An IAM user must have the
sts:AssumeRole
 policy to use the temporary security credentials in the same or different AWS account.
The following sample policy allows an IAM user to use the temporary security credentials in an AWS account: 
{
"Version":"2012-10-17", "Statement":{ "Effect":"Allow", "Action":"sts:AssumeRole", "Resource":"arn:aws:iam::<ACCOUNT-HYPHENS>:role/<ROLE-NAME>" }
}
The following sample policy allows an IAM user for the China region to use the temporary security credentials in an AWS account: 
{
"Version":"2012-10-17", "Statement":{ "Effect":"Allow", "Action":"sts:AssumeRole", "Resource":"arn:aws-cn:iam::<ACCOUNT-HYPHENS>:role/<ROLE-NAME>" }
}
IAM role
An IAM role must have a
sts:AssumeRole
 policy and a trust policy attached with the IAM role to allow the IAM user to access the AWS resource using the temporary security credentials. The policy specifies the AWS resource that the IAM user can access and the actions that the IAM user can perform. The trust policy specifies the IAM user from the AWS account that can access the AWS resource.
The following policy is a sample trust policy: 
{
"Version":"2012-10-17", "Statement":[{ "Effect":"Allow", "Principal":{ "AWS":"arn:aws:iam::AWS-account-ID:root" },
"Action":"sts:AssumeRole" }  
 ]
  }
   }
Here, in the
Principal
 attribute, you can also provide the ARN of IAM user who can use the dynamically generated temporary security credentials and to restrict further access. For example, 
"Principal" : { "AWS" : "arn:aws:iam:: AWS-account-ID :user/ user-name " }
To use the temporary security credentials with AWS Key Management Service (AWS KMS)-managed customer master key and enable the encryption with KMS, you must create a KMS policy.
You can perform the following operations to use the temporary security credentials and enable the encryption with KMS:
  • GenerateDataKey
  • DescribeKey
  • Encrypt
  • Decrypt
  • ReEncrypt
Sample policy: 
{
"Version":"2012-10-17", "Statement":[{ "Effect":"Allow", "Action":[ "kms:GenerateDataKey", "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*" ], "Resource": ["arn:aws:kms:region:account:key/<KMS_key>"] 
	}
  ] 
   }
When you configure KMS and access an Amazon S3 endpoint in the China region, use the following sample policy: 
{
"Version":"2012-10-17", "Statement":[{ "Effect":"Allow", "Action":[ "kms:GenerateDataKey", "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*" ], "Resource": ["arn:aws-cn:kms:region:account:key/<KMS_key>"] 
	}
  ] 
   }
0 COMMENTS
We’d like to hear from you!