Grant Index access to your Amazon S3 bucket

Before you begin: Create your Amazon S3 bucket.

This topic explains how you can securely grant Index Exchange (Index) read/write access to an Amazon S3 bucket using cross-account Identity and Access Management (IAM) roles.

Index Cloud partners: If you are granting access so Index can deploy model updates to your container, follow Grant Index access to your S3 model bucket instead.

Workflow

To grant access to Index, follow this workflow:

1. Create an IAM role in your AWS account.

2. Grant that role read/write access to your S3 bucket.

3. Allow an Index IAM role to assume your AWS IAM role.

4. Share the Role ARN with Index.

Note: Contact your Index Representative to request the Index IAM Role ARN (Amazon Resource Name) that will assume your AWS IAM role. You'll need this Role ARN to configure the trust relationship in step 3. Since Index can't generate this ARN until after you've created your IAM role, ask your Index Representative for a placeholder ARN to use when configuring the trust relationship, then update it with the final Role ARN.

Create an IAM role in your AWS account

Create an IAM role that will be assumed by Index to access your S3 bucket:

1. Sign in to the AWS Management Console.

2. Go to IAM > Roles.

3. Click Create role.

4. Choose Custom trust policy.

5. Name the role.

   For example: indexexchange-s3-role.

Grant S3 bucket permissions

Read permission

Attach a permissions policy to the role that grants read access to a subfolder of your S3 bucket. Replace <PARTNER_BUCKET_NAME> with your S3 bucket name, and <PREFIX> with the subfolder Index should read from (for example, index-models):

1. In the role, go to Permissions.

2. Click Add permissions > Create inline policy.

3. Choose JSON and paste the following policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "s3:ListBucket",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>",
			"Condition": {
				"StringLike": {
					"s3:prefix": ["<PREFIX>", "<PREFIX>/*"]
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": "s3:GetObject",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>/<PREFIX>/*"
		}
	]
}
		

To grant read access to the whole bucket instead, remove the Condition block and change the s3:GetObject resource to arn:aws:s3:::<PARTNER_BUCKET_NAME>/*.

Write permission

Attach a permissions policy to the role that grants write access to your S3 bucket, replacing <PARTNER_BUCKET_NAME> with your S3 bucket name:

1. In the role, go to Permissions.

2. Click Add permissions > Create inline policy.

3. Choose JSON and paste the following policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "s3:ListBucket",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>"
		},
		{
			"Effect": "Allow",
			"Action": "s3:GetObject",
			"Resource": "arn:aws:s3:::<PARTNER_BUCKET_NAME>/*"
		}	
	]
}

Configure the trust relationship

The trust relationship defines who is allowed to assume the IAM role. Update the role’s trust relationship with the following JSON, replacing <INDEX_INTERNAL_ROLE_ARN> with the Role ARN provided by Index:

{ 
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "<INDEX_INTERNAL_ROLE_ARN>"
			},
			"Action": "sts:AssumeRole"
		}
	]
} 

The <INDEX_INTERNAL_ROLE_ARN> must be the exact Role ARN provided by Index. However, because Index can't generate it until after you've created your IAM role and permission policies, you won't have the real value for <INDEX_INTERNAL_ROLE_ARN> at this point. Your Index Representative can supply a valid placeholder ARN value to use in the meantime.

An ExternalId condition may be added if required by your security team or requested by Index.

Share the Role ARN with Index

After the role and policies are created, copy the Role ARN from the IAM console and share it securely with Index, along with your bucket's name, URL, and region.

Once Index creates the Role ARN and sends it back to you, re-configure the trust relationship to replace the placeholder ARN provided by Index with the final Role ARN.

After you finish: Register your segments using a taxonomy file.