Amazon S3 Analytics Assume Role Connector

​

Intro

​

Best Practices

• Understanding the data stored in S3 Analytics Connector and its relation to other S3 databases will be a huge asset in using this connector.

​

Prerequisites

1. Add a new user, setting options as follows:
   1. In the Details pane, check the box for Programmatic Access under Select AWS access type.
      
   2. In the Permissions pane, select Attach existing policies directly, then check the box for either AmazonS3FullAccess or AmazonS3ReadOnlyAccess. Customer-managed policies do not work.
      
   3. In the Review pane, click Create User.
2. After you create your user, copy the access and secret keys to use in the Credentials pane in Domo.

​

Trust policy configuration

{
   "Effect": "Allow",
   "Principal": {
      "AWS": "arn:aws:iam::*accountId*:root"
   },
   "Action": "sts:AssumeRole",
   "Condition": {
      "StringEquals": {
         "sts:ExternalId": "*customer externalID*"
      }
   }
}

• US: 339405024189
• AU: 010251424122
• EMEA (IE): 687132894031
• JP: 622384692065
• CA: 710710207408

​

Connecting to Your Amazon S3 Analytics Assume Connector Account

​

Creating an IAM role (console)

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
2. In the navigation pane of the console, choose Roles and then choose Create role.
3. Choose AWS account role type.
4. To create a role for your account, choose This account. To create a role for another account, choose Another AWS account and enter the Account ID to which you want to grant access to your resources. The administrator of the specified account can grant permission to assume this role to any IAM user in that account. To do this, the administrator attaches a policy to the user or a group that grants permission for the sts:AssumeRole action. That policy must specify the role’s ARN as the Resource.
5. If you are granting permissions to users from an account that you do not control, and the users will assume this role programmatically, select Require external ID. The external ID can be any word or number that is agreed upon between you and the administrator of the third-party account. This option automatically adds a condition to the trust policy that allows the user to assume the role only if the request includes the correct sts:ExternalID. For more information, see How to use an external ID when granting access to your AWS resources to a third party. Important Choosing this option restricts access to the role only through the AWS CLI, Tools for Windows PowerShell, or the AWS API. This is because you cannot use the AWS console to switch to a role that has an externalId condition in its trust policy. However, you can create this kind of access programmatically by writing a script or an application using the relevant SDK. For more information and a sample script, see How to Enable Cross-Account Access to the AWS Management Console in the AWS Security Blog.
6. If you want to restrict the role to users who sign in with multi-factor authentication (MFA), select Require MFA. This adds a condition to the role’s trust policy that checks for an MFA sign-in. A user who wants to assume the role must sign in with a temporary one-time password from a configured MFA device. Users without MFA authentication cannot assume the role. For more information about MFA, see Using multi-factor authentication (MFA) in AWS
7. Choose Next.
8. IAM includes a list of the AWS managed and customer managed policies in your account. Select the policy to use for the permissions policy or choose Create policy to open a new browser tab and create a new policy from scratch. For more information, see Creating IAM policies. After you create the policy, close that tab and return to your original tab. Select the check box next to the permissions policies that you want anyone who assumes the role to have. If you prefer, you can select no policies at this time, and then attach policies to the role later. By default, a role has no permissions.
9. (Optional) Set a permissions boundary. This is an advanced feature. Open the Set permissions boundary section and choose Use a permissions boundary to control the maximum role permissions. Select the policy to use for the permissions boundary.
10. Choose Next.
11. For Role name, enter a name for your role. Role names must be unique within your AWS account. They are not distinguished by case. For example, you cannot create roles named both PRODROLE and prodrole. Because other AWS resources might reference the role, you cannot edit the name of the role after it has been created.
12. (Optional) For Description, enter a description for the new role.
13. Choose Edit in the Step 1: Select trusted entities or Step 2: Add permissions sections to edit the use cases and permissions for the role.
14. (Optional) Add metadata to the role by attaching tags as key–value pairs. For more information about using tags in IAM, see Tagging IAM resources.
15. Review the role and then choose Create role.

​

Credentials Pane

​

Details Pane

​

Troubleshooting

• Ensure that the file is present in the S3 bucket and that the correct file type is specified in the connector settings.
• NULL columns must be removed before the connector can successfully retrieve data.
• If you run into a “Failed to Import Successfully” error when trying to import a CSV file, you can often get around this by changing the option in the Quote Character menu to No Quote Character.

​

Other Panes