Secure export AWS authentication

Learn how to export data to your S3 bucket without providing AWS static credentials.

Contact Reltio Customer Support to obtain the Reltio AWS Account ID, which you'll need to configure AWS IAM authentication.

The Reltio Export Service enables you to write export output files in their own storage buckets using export API calls.

Reltio uses a secure approach for AWS customers based on the use of AWS IAM assumed roles. You must use AWS IAM AssumeRole based security while calling the Reltio Export service. This eliminates the need to provide static credentials. To achieve this, you need an additional one-time configuration in both the Reltio account and your AWS account to set up roles and a trusted relationship.

To configure secure AWS authentication:

Create an AWS S3 bucket.
For example, reltio-cross-account-export-bucket.
Create an AWS access policy.
For example, s3-reltio-export-policy.
You can read, write, and list access to your S3 bucket.
- List: ListBucket
- Read: GetObject
- Write: PutObject, DeleteObject
Create an AWS role.

For example, reltio-exporter. Now, you can access the policy.
Add another AWS Account for the role type.

Specify the Reltio AWS Account ID as the account that can use this role.
Set the maximum CLI/API session duration to 12 hours.

This provides the Reltio export service sufficient time to complete writing to an S3 bucket for larger exports.
Enter the credentials:
1. Add the Account ID.
  
  For example, 111122223333.
2. Add the ARN Number.
  
  For example, arn:aws:iam::123456789876: user/reltio.platform.jobs.
Assign the policy to the role.

For example, you can assign policy s3-reltio-export-policy to the role reltio-exporter.

Provide the role ARN to Reltio Customer Support.

Reltio will then configure an AWS role within the trusted account to assume the customer’s role when it needs to write to the customer’s S3 bucket.

Export Service HTTP headers

AWS access key and secret key will no longer be used once this AWS AssumeRole is set up. You must provide an AWS IAM AssumeRole instead.

HTTP headers

See Table 1: HTTP headers for the HTTP headers.

Table 1. HTTP headers
HTTP Header	Description	Example
`s3Bucket`	Customer S3 bucket.	`mys3bucket`
`s3Path`	Customer S3 path where the export output files are placed.	`/reltio-export-output/mypath/`
`roleArn`	Customer IAM role where the trust relationship was defined for Reltio to assume the role.	`arn:aws:iam:999999999999:role/reltio-exporter`
`externalId`	Customer’s unique identifier for granular control over role access.	`5ez83245-6b31-4df3-9bd2-0a0t25b3f9c9zz`

You've found your way to a temporary environment. Content is not complete or final. Looking for Reltio documentation? Go to docs.reltio.com.

© 2024 The RELTIO® mark is a registered trademark of Reltio, Inc. in the United States and other countries; DataDriven and Reltio Data Cloud are trademarks of Reltio, Inc. Other names or marks are trademarks of their respective owners.

Terms, Privacy Policy, and

Unify and manage your data

Secure export AWS authentication

Footer