Amazon S3 V2 Connector

Back Next

Rules and guidelines for AssumeRole via IAM user authentication

Consider the following guidelines for Assume Role via IAM user authentication:

The IAM user or IAM role that requests for the temporary security credentials must not have access to any AWS resources.

Only authenticated IAM users or IAM roles can request for the temporary security credentials from the AWS Security Token Service (AWS STS).

Before you run a task, ensure that you have enough time to use the temporary security credentials for running the task. You cannot extend the time duration of the temporary security credentials for an ongoing task.

For example, when you read from

and write to

Amazon S3 and if the temporary security credentials expire, you cannot extend the time duration of the temporary security credentials which causes the task to fail.

After the temporary security credentials expire, AWS does not authorize the IAM users or IAM roles to access the resources using the credentials. You must request for new temporary security credentials before the previous temporary security credentials expire in a mapping.

For mappings in advanced mode, the temporary security credentials do not expire even after the configured time in the

Temporary Credential Duration

advanced source property elapses.

Do not use the root user credentials of an AWS account to use the temporary security credentials. You must use the credentials of an IAM user to use the temporary security credentials.

If both the source and target in a mapping point to the same Amazon S3 bucket, use the same Amazon S3 connection in the Source and Target transformations. If you use two different Amazon S3 connections, configure the same values in the connection properties for both the connections.

If the source and target in a mapping point to different Amazon S3 buckets, you can use two different Amazon S3 connections.

You can configure different values in the connection properties for both the connections. However, you must select the

Use EC2 Role to Assume Role

check box in the connection property. You must also specify the same value for the

Temporary Credential Duration

field in the source and target properties.

In a mapping, if you configure two or more Amazon S3 data sources from the same Amazon S3 bucket with different IAM roles, each IAM role must be able to access the data source of the other IAM role.

In a mapping with two data sources, if you set up one Amazon S3 data source to use user credentials and another to use an IAM role, consider the following rules:

The IAM user for the first data source must also be able to assume the IAM role of the second Amazon S3 data source.

The IAM role that you configured for the second data source must also have access to the first Amazon S3 data source.

Rename Saved Search

Table of Contents

Amazon S3 V2 Connector

Amazon S3 V2 Connector

Rules and guidelines for AssumeRole via IAM user authentication

Rules and guidelines for AssumeRole via IAM user authentication