AWS S3

We write each new build of the databases you choose to a bucket of yours: to Amazon S3 as an IAM role you let us take on, or to any S3-compatible storage with an access key. What lands in the bucket, and when, is on Database Delivery.

Amazon S3

We take on a role in your AWS account that can write only where you say, so there's no key to create or hand over. In the console, add an Amazon S3 destination with the bucket, its region and a folder, and save. The destination then shows both policies below with your bucket, folder and its External ID filled in. Here the bucket is acme-data and the folder databases.

Create a role with this trust policy. It lets our account take the role on, and only with this destination's External ID, so nobody else's destination can use it:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::079769603397:user/vpndetection-delivery" },
      "Action": "sts:AssumeRole",
      "Condition": { "StringEquals": { "sts:ExternalId": "vpndetection-1a2b3c4d5e6f7a8b9c0d1e2f" } }
    }
  ]
}

Give it this permissions policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::acme-data/databases/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::acme-data"
    }
  ]
}

aws iam create-role --role-name vpndetection-delivery --assume-role-policy-document file://trust-policy.json
aws iam put-role-policy --role-name vpndetection-delivery --policy-name database-delivery \
  --policy-document file://policy.json

Paste the role's ARN into the destination, save, and Test connection: it writes vpndetection-connection-test.txt to the folder and deletes it again. Activate once it passes.

s3:DeleteObject and s3:ListBucket are what Every build needs to delete dated folders past their days, and what the test needs to clean up after itself. We never read your objects, so the role needs no s3:GetObject. If the bucket encrypts with a KMS key of yours, give the role kms:GenerateDataKey and kms:Decrypt on that key too.

With an access key

If you'd rather not create a role, an IAM user with the same permissions policy and an access key works too. Add an S3-compatible storage destination instead:

S3-compatible storage

Any storage with an S3 API works the same way: give us an access key that can write to the bucket, and its endpoint.

Leave Path-style addressing on unless your provider says otherwise; Amazon S3 is the one that doesn't need it. The endpoint has to be https:// on a public address.