AWS S3 Connector

Roe AI uses programmatic access to connect to the S3 bucket. You create a new user in the IAM Management Console, assign in to a group, and then create a policy that grants access to the specified S3 bucket.

Create the policy

1. Add a new user through the IAM Management Console. You can add the user to an existing group or create a new group in which to add them. Once created, generate a set of access keys . You provide the access key and secret access key when creating an S3 resource in Roe AI.

2. Configure permissions for S3 buckets using policies . Create a new policy using the IAM Management Console that grants sufficient permission to read and write data to the S3 bucket.

3. Use the console’s GUI to create permissions or provide a JSON configuration. The following configuration grants access to read and write data for the specified S3 bucket. Update the BUCKET_NAME placeholders with the name of your bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketAcl",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketNotification",
                "s3:GetBucketPolicy",
                "s3:GetBucketWebsite",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectVersionTagging"
            ],
            "Resource": [
                "arn:aws:s3:::REPLACE_THIS_BUCKET_NAME",
                "arn:aws:s3:::REPLACE_THIS_BUCKET_NAME/*"
            ]
        }
    ]
}

Attach the policy

You can attach the policy to either the user or the group to which it belongs. Select the user group in which the user you created is assigned, then attach the policy.

If you want to avoid having permanent permissions for the S3 bucket granted to your IAM user, you can configure the user to assume a role that has sufficient permissions.

Once the policy is attached, you can create the S3 resource in Roe AI.