S3 Dynamic Account

Owned by Lakshmi Manda
Last updated: Feb 13, 2024 by Kalpana Malladi
3 min read

In this article

Overview

You can use this account type to connect Binary Snaps with data sources that use an S3 account.

Expression-enabled authentication fields, such as Username, Password, and Client Secret, support Secrets Management, a SnapLogic add-on that allows you to store endpoint credentials in a third-party secrets manager, such as AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault. During validation and execution, pipelines obtain the credentials directly from the secrets manager. Learn more: Configure Accounts to use secrets.

Prerequisites

The s3:ListAllMyBuckets permission is required to successfully validate an S3 account. Refer to the Account Permissions section below for additional permissions required for the target resources based on the task to be performed.

Account Settings

 

  • Asterisk (*): Indicates a mandatory field.

  • Suggestion icon (): Indicates a list that is dynamically populated based on the configuration.

  • Expression icon (): Indicates whether the value is an expression (if enabled) or a static value (if disabled). Learn more about Using Expressions in SnapLogic.

  • Add icon (): Indicates that you can add fields in the fieldset.

  • Remove icon (): Indicates that you can remove fields from the fieldset.

Field Name

Field Type

Description

Field Name

Field Type

Description

Label

Default Value: None
Example: S3 Dynamic Account

String

Specify a unique label for the account.

Access-key ID

Default Value: None
Example: xyz876jhnJKBuya9730

String/Expression

 

The Access key ID part of AWS authentication.

Secret key

Default Value: [None]
Example: bn098&^*jhj34kxii0/?

String/Expression

 

The Secret key part of AWS authentication.

Security Token

Default value: [None
Example: XZlkdf129LONmn65n=

String/Expression

The Security token part of AWS Security Token Service (STS) credentials.

Server-side encryption

Default value: Not Selected
Example:

Checkbox

The type of encryption to use for the objects stored in S3. For Snaps that write objects to S3, this field defines how the objects will be encrypted. For Snaps that read objects from S3, this field is not required.

KMS Encryption type

Default value: None
Example: Server side KMS Encryption

Dropdown list

 

The AWS Key Management Service key used to encrypt S3 objects. It can be the key ID or ARN. The available options are:

  • None: The files do not get encrypted using KMS encryption.

  • Server side KMS Encryption: The output files on Amazon S3 are encrypted using this encryption with Amazon S3 generated KMS key.

  • Client side KMS Encryption: The output files on Amazon S3 are encrypted using this encryption with client generated KMS key.

For Snaps that write objects to S3, this is required for encryption types Server-Side encryption with AWS KMS-Managed Keys and Client-Side encryption with AWS KMS-Managed Keys. For Server-Side encryption, the key must be in the same region as the S3 bucket. For Client-Side encryption, a key from any region can be used by using the key ARN value. If a key ID is used for Client-Side encryption, it defaults to the us-east-1 region.

For Snaps that read objects from S3, this field is not required. 

KMS key

Default value: None
Example: cvcv866kALm920

String/Expression

 

The AWS Key Management Service key used to encrypt S3 objects. It can be the key ID or ARN. 

For Snaps that write objects to S3, this is required for encryption types Server-Side encryption with AWS KMS-Managed Keys and Client-Side encryption with AWS KMS-Managed Keys. For Server-Side encryption, the key must be in the same region as the S3 bucket. For Client-Side encryption, a key from any region can be used by using the key ARN value. If a key ID is used for Client-Side encryption, it defaults to the us-east-1 region.

For Snaps that read objects from S3, this field is not required.

KMS region

Default value: None
Example: us-east-1

String/Expression

The AWS region where the KMS key is located.

Cross Account IAM Role

Use this field set to manage account access. Learn more about setting up Cross Account IAM Role.

Role ARN

Default value: None

String/Expression

The Amazon Resource Name of the role to assume.

 

External ID

Default value: None

String/Expression

An optional external ID that might be required by the role to assume.

 

Support IAM role max session duration

Checkbox

Select this checkbox when you want to extend the maximum session duration of an IAM role defined in AWS. On selecting this checkbox, the cross account IAM role is assumed with the maximum session duration defined for the IAM role.

This checkbox is deselected by default. The default maximum session duration for an IAM role is one hour; however, you can define a custom duration between 1-12 hours. Learn how to increase the IAM role maximum session duration limit.
We recommend that you select this checkbox if the maximum session duration of the IAM role is greater than an hour.

 

 

Have feedback? Email documentation@snaplogic.com | Ask a question in the SnapLogic Community
© 2017-2024 SnapLogic, Inc.