This field is required if the IAM role is disabled.

This field is required if the IAM role is disabled.

The Amazon S3 Snaps automatically detect the Maximum session duration value for the Cross-Account IAM role (1 through 12 hours). The Snaps round down the value to the nearest hour. So, if the Snap administrator sets the Maximum session duration at 3 hours and 45 minutes, the Snaps read it as 3 hours. The Snaps also refresh the session before it expires. However, the automatic session refresh does not support the case of very large file upload or download that takes longer than the maximum session duration.

• The IAM role is valid in Groundplex nodes hosted in the EC2 and ECS environments.

  • For EC2, set the global properties (Key and Value) on the Groundplex as shown below and restart the JCC: 
    jcc.jvm_options = -DIAM_CREDENTIAL_FOR_S3=TRUE

  • For ECS, update the task definition environment variables as follows:

[

{
                    "name": "LANG",
                    "value": "en_US.UTF-8"
                },
                {
                    "name": "LC_ALL",
                    "value": "en_US.UTF-8"
                },
                {
                    "name": "JAVA_TOOL_OPTIONS",
                    "value": "-Dfile.encoding=UTF-8 -Dsun.jnu.encoding=UTF-8"
                }
            ]

• The List, Read, and Write permissions are required as per the attached S3 policy for the IAM role stored on the EC2 and ECS instances. 

• When you select the IAM Role checkbox and validate the account, an error is displayed, and the account is not validated. To use the account, provide valid Role ARN and External ID values, and then click the Apply button.

When you use the Cross Account IAM Role in the Amazon S3 account, the ownerDisplayName and ownerID fields in the output document of the S3 Browser Snap may be empty.

• For Snaps that read objects from S3, this field is not required. 

• For Snaps that write objects to S3, this is required for encryption types—Server-Side encryption and Client-Side encryption with AWS KMS-Managed Keys.

  • For Server-Side encryption, the key must be in the same region as the S3 bucket.

  • For Client-Side encryption, a key from any region can be used by using the key ARN value. If a key ID is used for Client-Side encryption, it defaults to the us-east-1 region.

• This is required only if the KMS Encryption type property is configured to use the encryption with KMS. Learn more about AWS KMS Overview and Using Server Side Encryption. 

• For Snaps that write objects to S3, this is required for encryption types Server-Side encryption with AWS KMS-Managed Keys and Client-Side encryption with AWS KMS-Managed Keys.

  • For Server-Side encryption, the key must be in the same region as the S3 bucket.

  • For Client-Side encryption, a key from any region can be used by using the key ARN value. If a key ID is used for Client-Side encryption, it defaults to the us-east-1 region.

This field is not required for most buckets, and if the bucket's region belongs to one of the default regions, you can leave it blank. However, this field is required if the account validation fails and if the bucket is in a recently added AWS region.