The IAM user or IAM role that requests for the temporary security credentials must not have access to any AWS resources.

Only authenticated IAM users or IAM roles can request for the temporary security credentials from the AWS Security Token Service (AWS STS).

Before you run a task, ensure that you have enough time to use the temporary security credentials for running the task. You cannot extend the time duration of the temporary security credentials for an ongoing task. For example, when you read from

and write to

Amazon S3 V2 and if the temporary security credentials expire, you cannot extend the time duration of the temporary security credentials that causes the task to fail.

After the temporary security credentials expire, AWS does not authorize the IAM users or IAM roles to access the resources using the credentials. You must request for new temporary security credentials before the previous temporary security credentials expire in a mapping.

For mappings in advanced mode, the temporary security credentials do not expire even after the configured time in the

Temporary Credential Duration

advanced source property elapses.

Do not use the root user credentials of an AWS account to use the temporary security credentials. You must use the credentials of an IAM user to use the temporary security credentials.

Using temporary security credentials to read data from

or write data to

a complex file such as Avro, ORC, or Parquet file depends on the Hadoop distribution in your environment. However, to read data from

or write data to

a flat file using the temporary security credentials, no Hadoop distribution is required by Amazon S3 V2 Connector.

If both the source and target in a mapping point to the same Amazon S3 bucket, use the same Amazon S3 connection in the Source and Target transformations. If you use two different Amazon S3 connections, configure the same values in the connection properties for both the connections.

If the source and target in a mapping point to different Amazon S3 buckets, you can use two different Amazon S3 connections.

In a mapping, if you configure two or more Amazon S3 data sources for the same Amazon S3 bucket with different IAM roles, either of the IAM roles must be able to access the other data source as well.

In a mapping, if you configure one Amazon S3 data source with user credentials and the other Amazon S3 data source with an IAM role, consider the following rules:

The user credentials for the first data source must also be able to assume the IAM role of the second Amazon S3 data source.
The IAM role that you configured for the second data source must also have access to the first Amazon S3 data source.