Overview

ConductorOne automatically syncs with the connected S3 bucket every hour, so data updated in the S3 bucket is reflected in the ConductorOne application.

Availability

✅ General availability. The AWS S3 data source integration is available to all ConductorOne users.

Requirements

When connecting to your AWS environment, you will need:

• Super Administrator role in ConductorOne
• Ability to create an IAM Role in AWS
  • ConductorOne uses an IAM Trust relationship between your AWS Account and ConductorOne’s Service AWS Account.
  • This is the AWS-recommended method of sharing access to AWS Accounts. ConductorOne has a specially created and isolated AWS Account dedicated to the AWS integration.
  • For advanced configurations, the only trusted entity should be the following ARN: arn:aws:iam::765656841499:role/ConductorOneS3DatasourceService

Integrate your AWS account

Step 1: Get a ConductorOne-provided External ID for the AWS IAM Role

Do not close the ConductorOne window during the integration process. If you close the window, a new External ID is generated. This is a known issue and will be fixed.

1. Log into ConductorOne.
2. Click Integrations, and click S3 in the Data Sources section of the page.
3. Copy and save the External ID generated for you by ConductorOne. You’ll use this value in Step 2.

Step 2: Create an AWS IAM Role for ConductorOne

1. In a new browser tab, navigate to AWS and sign into your AWS account.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. Click Roles > Create Role.

4. Select Custom Trust Policy and paste the following code into the Trust Policy JSON editor, replacing <EXTERNAL ID FROM C1> with the value you saved in Step 1.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::765656841499:role/ConductorOneS3DatasourceService"
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "<EXTERNAL ID FROM C1>"
           }
         }
       }
     ]
   }
   

5. Click Next.

6. Do not make any changes on the Add permissions page. Click Next.

7. On the Name, review, and create page, in the Role Name field, enter ConductorOneIntegration.

8. Optional. Add any tags relevant to your organization.

9. Click Create role.

10. Back on the Roles page, click on the newly created ConductorOneIntegration role to view the role’s details.

11. Under Permissions Policies, click Add Permissions and select Create Inline Policy.

12. Click the JSON Editor tab and paste in the following code:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "s3:GetObject",
            "s3:GetObjectAttributes",
            "s3:GetBucketLocation",
            "s3:ListBucket"
          ],
          "Resource": [
            "arn:aws:s3:::<BUCKET NAME>",
            "arn:aws:s3:::<BUCKET NAME>/*"
          ]
        }
      ]
    }
    

13. Click Review Policy.

14. In the Name field, enter ConductorOnePermissions.

15. Click Create policy.

16. Copy and save the Role ARN for the newly created policy. The Role ARN is formed as arn:aws:iam::<UNIQUE STRING>:role/ConductorOneIntegration. You’ll use this value in Step 3.

    

Step 3: Connect an S3 Data Source to ConductorOne

1. Return to the ConductorOne Integrations page and (if necessary) click S3 to reopen the data source settings.
2. Paste the Role ARN you generated in Step 2 into the Role ARN field.
3. Enter the name of the S3 bucket that contains the files you want to use in ConductorOne.
4. Click Next.

Step 4: Connect the Data Source to an Application

1. Navigate to a ConductorOne application.
2. Click the Imports tab. Click Import App Data and select From Data Source.
3. Click Choose a datasource and select the name of your S3 bucket.
4. In the File Name field, enter the name of the file you want to import to the application.
5. Click Import.