Secure export AWS authentication

Learn how to export data to your S3 bucket without providing AWS static credentials.

The Reltio Export service enables you to write export output files in your own storage buckets using export API calls.

Reltio uses a secure approach for AWS customers based on the use of AWS IAM assumed roles. You must use AWS IAM AssumeRole based security while calling the Reltio Export service. This eliminates the need to provide static credentials. To achieve this, you need an additional one-time configuration in both the Reltio account and your AWS account to set up roles and a trusted relationship.

Note: AWS access key and secret are being deprecated. For more details see this deprecation notice: AWS access key and secret in favor of IAM roles for Reltio-owned resources.

Prerequisites

Before you begin, create a support request to obtain the Reltio AWS Account ID and the Reltio principal ARNs to add to your role's trust policy. In the support request, specify whether your export is HIPAA or non-HIPAA compliant.

To configure secure AWS authentication:

Create an AWS S3 bucket.
For example, reltio-cross-account-export-bucket.
Create an AWS access policy.
For example, s3-reltio-export-policy.
You can read, write, and list access to your S3 bucket.
- List: ListBucket
- Read: GetObject
- Write: PutObject, DeleteObject
Create an AWS role.

For example, reltio-exporter. Now, you can access the policy.
Add another AWS Account for the role type.

Specify the Reltio AWS Account ID as the account that can use this role.
Set the maximum CLI/API session duration to 12 hours.

This provides the Reltio export service sufficient time to complete writing to an S3 bucket for larger exports.
Enter the credentials:
1. Add the Reltio AWS Account ID.
  
  For example, 111122223333.
2. Add the Reltio principal ARN Number.
  Use the Reltio principal ARN you received from Reltio Support.
  
  For example, arn:aws:iam::123456789876:user/reltio.platform.jobs.
Assign the policy to the role.

For example, you can assign policy s3-reltio-export-policy to the role reltio-exporter.

Specify your IAM role in each export API request.

Once your role's trust policy includes the Reltio principals, the Reltio export service assumes the role when it needs to write to your S3 bucket. Use the roleArn HTTP header to specify the role, along with the other Export service HTTP headers.

Export Service HTTP headers

Table 1. HTTP headers
HTTP Header	Description	Example
`s3Bucket`	Customer S3 bucket.	`mys3bucket`
`s3Path`	Customer S3 path where the export output files are placed.	`/reltio-export-output/mypath/`
`roleArn`	Customer IAM role where the trust relationship was defined for Reltio to assume the role.	`arn:aws:iam:999999999999:role/reltio-exporter`
`externalId`	Customer's unique identifier for granular control over role access.	`5ez83245-6b31-4df3-9bd2-0a0t25b3f9c9zz`

Unify and manage your data

Secure export AWS authentication

Footer