Grant Index access to your Amazon S3 bucket

Before you begin: Create your Amazon S3 bucket.

This topic explains how you can securely grant Index Exchange (Index) read/write access to an Amazon S3 bucket using cross-account Identity and Access Management (IAM) roles.

Workflow

To grant access to Index, follow this workflow:

1. Create an IAM role in your AWS account.

2. Grant that role read/write access to your S3 bucket.

3. Allow an Index IAM role to assume your AWS IAM role.

4. Share the Role ARN with Index.

Note: Contact your Index Representative to request the Index IAM Role ARN (Amazon Resource Name) that will assume your AWS IAM role. You'll need this Role ARN to configure the trust relationship in step 3. Since Index can't generate this ARN until after you've created your IAM role, start by using a placeholder value when configuring the trust relationship, then update it with the real Role ARN once Index provides it.

Create an IAM role in your AWS account

Create an IAM role that will be assumed by Index to access your S3 bucket:

1. Sign in to the AWS Management Console.

2. Go to IAM > Roles.

3. Click Create role.

4. Choose Custom trust policy.

5. Name the role.

   For example: indexexchange-s3-role.

Grant S3 bucket permissions

Note: For both read and write permissions, it is optional but recommended that you restrict the s3:GetObject resource accordingly. For example: arn:aws:s3:::bucket-name/path/*.

Read permission

Attach a permissions policy to the role that grants read access to your S3 bucket, replacing <PARTNER_BUCKET_NAME> with your S3 bucket name:

1. In the role, go to Permissions.

2. Click Add permissions > Create inline policy.

3. Choose JSON and paste the following policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "s3:ListBucket",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>"
		},
		{
			"Effect": "Allow",
			"Action": "s3:GetObject",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>/*"
		}	
	]
}
		

Write permission

Attach a permissions policy to the role that grants write access to your S3 bucket, replacing <PARTNER_BUCKET_NAME> with your S3 bucket name:

1. In the role, go to Permissions.

2. Click Add permissions > Create inline policy.

3. Choose JSON and paste the following policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "s3:ListBucket",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>"
		},
		{
			"Effect": "Allow",
			"Action": "s3:GetObject",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>/*"
		}	
	]
}

Configure the trust relationship

The trust relationship defines who is allowed to assume the IAM role. Update the role’s trust relationship with the following JSON, replacing <INDEX_INTERNAL_ROLE_ARN> with the Role ARN provided by Index:

{ 
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "<INDEX_INTERNAL_ROLE_ARN>"
			},
			"Action": "sts:AssumeRole"
		}
	]
} 

The <INDEX_INTERNAL_ROLE_ARN> must be the exact Role ARN provided by Index. However, because Index can't generate it until after you've created your IAM role and permission policies, you won't have the real value for <INDEX_INTERNAL_ROLE_ARN> at this point. Start by using a placeholder value, for example:

"AWS": "arn:aws:iam::000000000000:role/placeholder"
	

An ExternalId condition may be added if required by your security team or requested by Index.

Share the Role ARN with Index

After the role and policies are created, copy the Role ARN from the IAM console and share it securely with Index, along with your bucket's name, URL, and region.

Once Index creates the Role ARN and sends it back to you, re-configure the trust relationship to replace the placeholder Role ARN with the one provided by Index.

After you finish: Register your segments using a taxonomy file.