Learn how to configure an AWS IAM role with an External ID to securely access Amazon S3 files in the Console Data Loader.

1. Open the IAM service in your AWS account and create a new role or configure an existing one, with the following ARN structure:

   {
     "role": "arn:aws:iam::arn:aws:iam::123456789012:role/reltio.client.dataloader.reader",
     "externalId": "reltio-dataloader",
     "region": "us-east-1"
   }

2. Define the trust policy to allow Reltio to assume the role using an External ID:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal":  [
                   "arn:aws:iam::<RELTIO_AWS_ACCOUNT_ID>:user/RW_reltio.console-jobs.internal",
                   "arn:aws:iam::<RELTIO_AWS_ACCOUNT_ID>:user/reltio.platform.sc-dataloader-prod",
                   "arn:aws:iam::<RELTIO_AWS_ACCOUNT_ID>:role/role-RW-reltio-console-jobs-internal",
                   "arn:aws:iam::<RELTIO_AWS_ACCOUNT_ID>:role/role-reltio.platform.sc-dataloader-prod"
               ],
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "reltio-dataloader"
           }
         }
       }
     ]
   }

   You have to configure an External ID to use on the trust policy to ensure an extra security parameter. If the External ID is provided on the configuration the access to the S3 bucket is only granted to users that present the correct External ID when trying to load data. Use the External ID on the parameter sts:ExternalID.

   Important: You must always provide the four resource names under the "Principal" element. To know the the <RELTIO_AWS_ACCOUNT_ID> associated with the service you want to access, raise a support ticket. See topic Get help in Support Portal.

   Important: If you attempt to use a role without configuring these principals, it returns an error similar to User: arn:aws:iam::123456789012:user/reltio.console-jobs.internal is not authorized to perform..., the account ID 123456789012 in the error message is your <RELTIO_AWS_ACCOUNT_ID>.
3. Attach a permissions policy to the role that grants read-only access to your S3 bucket:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:ListBucket"
               ],
               "Resource": [
                   "arn:aws:s3:::reltio-dataloder-sources",
                   "arn:aws:s3:::reltio-dataloder-sources/*"
               ]
           }
       ]
   }

   Important: The resource arn:aws:s3:::reltio-dataloder-sources represents the root of your S3 bucket and the resource arn:aws:s3:::reltio-dataloder-sourcess/* represents all other sub-folders and content inside of the root. Both resources are mandatory and can't be skipped on this configuration.
4. Encode your credentials with base64.
   You can encode your credentials with base64 to generate a StorageDetails object.

   Take this role as example:

   {
     "role": "arn:aws:iam::arn:aws:iam::123456789012:role/reltio.client.dataloader.reader",
     "externalId": "reltio-dataloader",
     "region": "us-east-1"
   }

   Encoding it in base64 you have: ewogICJyb2xlIjogImFybjphd3M6aWFtOjphcm46YXdzOmlhbTo6MTIzNDU2Nzg5MDEyOnJvbGUvcmVsdGlvLmNsaWVudC5kYXRhbG9hZGVyLmxvYWRqb2IiLAogICJleHRlcm5hbElkIjogInJlbHRpby1kYXRhbG9hZGVyIiwKICAicmVnaW9uIjogInVzLWVhc3QtMSIKfQ==

   This can be used in the StorageDetails object:

     "storageDetails": {
       "bucketName": "reltio-dataloder-sources",
       "shareSourceInfo": "false",
       "sourcePath": "simple_DataSet_100_with_errors.csv",
       "storageAccount": {
         "accountName": "<some human-readable name>",
         "accountType": "AWS_S3",
         "credentials": "ewogICJyb2xlIjogImFybjphd3M6aWFtOjphcm46YXdzOmlhbTo6MTIzNDU2Nzg5MDEyOnJvbGUvcmVsdGlvLmNsaWVudC5kYXRhbG9hZGVyLmxvYWRqb2IiLAogICJleHRlcm5hbElkIjogInJlbHRpby1kYXRhbG9hZGVyIiwKICAicmVnaW9uIjogInVzLWVhc3QtMSIKfQ=="
       }
     }

   For more information on creating storage accounts, see our Developer Portal.

5. In Reltio Console > Data Loader, configure the source file location:
   1. Select Amazon S3 as the source type.
   2. Select the Authenticate using key/secret checkbox .
   3. Enter the details requested on the page.
   For more information on the Console > Data Loader see topic Data loading navigation.