Amazon S3 (Edge)

Prerequisites

• You have an active AWS account and an IAM user in the account with permission to:

  • Create an IAM policy.

  • Create an IAM role (to generate the IAM role-based credentials) or create an IAM user (to generate the access credentials).

• An Amazon S3 bucket in one of the supported AWS regions is available. Refer to the Create an Amazon S3 bucket section for the steps if you do not have one.

• The IAM role-based credentials or access credentials are available to enable Hevo to connect to your S3 bucket.

Create an Amazon S3 Bucket (Optional)

Create an IAM Policy for the S3 Bucket

To allow Hevo to access your S3 bucket and load data into it, you must create an IAM policy with the following permissions:

Perform the following steps to create the IAM policy:

1. Log in to the AWS IAM Console.

2. In the left navigation pane, under Access management, click Policies.

   

3. On the Policies page, click Create policy.

   

4. On the Specify permissions page, click JSON.

   

5. Paste the following JSON statements in the Policy editor:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:GetObject",
                   "s3:PutObject",
                   "s3:DeleteObject"
               ],
               "Resource": [
                   "arn:aws:s3:::<your_bucket_name>",
                   "arn:aws:s3:::<your_bucket_name>/*"
               ]
           }
       ]
   }
   

   Note: Replace the placeholder values in the commands above with your own. For example, <your_bucket_name> with s3-docs-20.

   The JSON statements allow Hevo to access the bucket that you specify while configuring S3 as an Edge Destination and load data into it.

6. At the bottom of the page, click Next.

   

7. On the Review and create page, specify the Policy name and then click Create policy at the bottom of the page.

   

You must assign this policy to the IAM role or user that you create so that Hevo can access your S3 bucket.

Obtain the External ID for your S3 Destinations

Hevo Edge auto-assigns an external ID to the S3 Destination type for your team, which remains unchanged. You need to obtain the value for this ID from the S3 Destination configuration screen.

1. Log in to your Hevo account and select DESTINATIONS in the Navigation Bar.

2. Click the Edge tab in the Destinations List View and click + CREATE EDGE DESTINATION.

3. On the Create Destination page, click S3.

4. In the Connect to your S3 section of the displayed screen, select Identity and Access Management (IAM) from the Access type drop-down.

5. Click the copy ( ) icon next to the value in the External ID field and save it securely.

   

You must add this external ID to the trust policy of the IAM role that you create for Hevo.

Obtain the S3 Bucket Connection Settings

Hevo connects to your S3 bucket in one of the following ways:

• Using an IAM role.

• Using access credentials.

Connect using the IAM role

To connect using an IAM role, you must generate IAM role-based credentials. For this, you need to add an IAM role for Hevo and assign to it the IAM policy created in Step 2. You also require the Amazon Resource Name (ARN) and the external ID obtained in Step 3 to grant Hevo access to your S3 bucket.

1. Create an IAM role and assign the IAM policy

1. Log in to the AWS IAM Console.

2. In the left navigation pane, under Access management, click Roles.

   

3. On the Roles page, click Create role.

   

4. On the Select trusted entity page, do the following:

   1. In the Trusted entity type section, select Custom trust policy.

      

   2. In the Custom trust policy section:

      

      1. Copy the following JSON statements and paste them into the editor window:

         {
             "Version": "2012-10-17",
             "Statement": [
                 {
                     "Effect": "Allow",
                     "Principal": {
                         "AWS": "arn:aws:iam::Hevo's AWS account ID:role/customer-aws_integration"
                     },
                     "Action": "sts:AssumeRole",
                     "Condition": {
                         "StringEquals": {
                             "sts:ExternalID": "External ID assigned by Hevo"
                         }
                     }
                 }
             ]
         }
         

      2. Replace Hevo’s AWS account ID in line 7 with 393309748692 and the External ID assigned by Hevo in line 12 with the value that you obtained in Step 3.

      3. At the bottom of the page, click Next.

5. On the Add Permissions page, in the Permissions policies section, select the policy you created in Step 2 and click Next at the bottom of the page.

   

6. On the Name, review, and create page, specify a Role name and a Description and then click Create role at the bottom of the page.

   

Once the role is created, you are redirected to the Roles page.

2. Obtain the ARN

1. On the Roles page of your IAM console, search for and click the role that you created above.

2. On the <Role name> page, in the Summary section, click the copy icon below the ARN field and save it securely like any other password.

   

You can specify this ARN while configuring S3 as a Destination in Edge.

Connect using access credentials

To connect using access credentials, you need to add an IAM user for Hevo and assign the policy created in Step 3 to it. You require the access key and the secret access key generated for this user to grant Hevo access to your S3 bucket.

Note: The secret key is associated with an access key and is visible only once. Therefore, you must save it or download the key file for later use.

1. Create an IAM user and assign the IAM policy

1. Log in to the AWS IAM Console.

2. In the left navigation pane, under Access management, click Users.

   

3. On the Users page, click Create user.

   

4. On the Specify user details page, specify the User name and click Next.

   

5. On the Set permissions page, in the Permissions options section, click Attach policies directly.

   

6. In the Search bar of the Permissions policies section, type the name of the policy you created in Step 3.

7. Select the check box next to the policy and then click Next at the bottom of the page.

   

8. At the bottom of the Review and create page, click Create user.

   

2. Generate the access keys

1. On the Users page of your IAM console, click the user that you created above.

   

2. On the <User name> page, in the Summary section, click Create access key.

   

3. On the Access key best practices & alternatives page, select Command Line Interface (CLI).

   

4. At the bottom of the page, select the I understand the above… check box and click Next.

   

5. (Optional) Specify a description tag for the access key to help you identify it.

6. Click Create access key.

   

7. On the Retrieve access keys page, in the Access key section, click the copy icon in the Access key and Secret access key fields and save the keys securely like any other password. Optionally, click Download .csv file to save the keys on your local machine.

   

8. Click Done.

You can use these access keys when configuring S3 as a Destination in Edge.