AWS IAM Policies for Access to AWS S3 in Analytics Canvas
To enable Analytics Canvas to interact with your Amazon S3 buckets, configure AWS Identity and Access Management (IAM) policies that grant the necessary permissions.
This guide outlines the required actions and provides a sample policy for seamless integration.
Required IAM Actions
Analytics Canvas requires specific permissions to perform operations such as authorizing your credentials, listing buckets, accessing objects, and uploading files.
The key actions include:
- s3:ListAllMyBuckets: Allows listing all buckets in your AWS account. Necessary for Analytics Canvas to display available buckets during configuration.
- s3:ListBucket, s3:GetObject, s3:PutObject, and related actions: Permit listing, downloading, and uploading files into a specific bucket.
Minimum Required IAM Policy
Below is an example IAM policy that grants the necessary permissions for Analytics Canvas to access a specific S3 bucket named your-bucket. This policy is divided into two sections:
- Global Permissions: Grants the ability to list all buckets and access S3.
- Bucket-Specific Permissions: Restricts read and write operations to the specific bucket or buckets.
Simply copy and paste the policy below as the only policy required for the user to upload and download files from an S3 bucket. Note these permissions do not allow the user to delete objects.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Authorize",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "SpecificBucketAccess",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:PutObject",
],
"Resource": [
"arn:aws:s3:::{your-bucket}",
"arn:aws:s3:::{your-bucket}/*"
]
}
]
}Implementing the Policy
To apply this policy:
- Log in to the AWS Management Console.
- Navigate to the IAM service.
- Select Policies from the sidebar menu.
- Click Create policy.
- In the JSON tab, paste the policy code provided above.
- Review the policy and click Next: Tags (optional).
- Click Next: Review.
- Provide a name and description for the policy.
- Click Create policy.
- Attach the policy to the IAM user or role used by Analytics Canvas.
Once the policy has been set for the user, generate an access key and secret. Then proceed to add a New account in Analytics Canvas and use the connector to read or write files to S3.