The AWS S3 data connector allows you to connect any S3 bucket to Cloudglue, enabling you to use your S3 URIs directly with our endpoints without manually uploading files.

​
How It Works

This connector creates a secure bridge between your S3 buckets and Cloudglue:
  • Direct S3 access - We only access your files when you explicitly use them
  • No manual uploads - Skip the process of manually uploading files to Cloudglue
  • S3 URI support - Use your existing S3 URIs directly with Cloudglue endpoints

​
Security

Security is paramount, so we use AWS best practices with cross-account IAM roles. You’ll create an IAM role in your AWS account that Cloudglue can assume to access your buckets. This approach:
  • Maintains your control - You own and manage the role
  • Follows AWS security patterns - Uses standard cross-account role assumption
  • Provides granular permissions - Only grants the minimum access needed
  • Easy to revoke - Simply delete the role or modify permissions

​
Setup Options

We provide a CloudFormation template that automates the entire setup process:
  1. Copy and deploy the template in your AWS account
  2. Provide us the role ARN that gets created
  3. Configure the connector on our web platform
The CloudFormation template handles all the IAM role creation, policies, and trust relationships automatically.

​
CloudFormation Template

One click deployment with CloudFormation

To use this template:
  1. Copy the YAML code above
  2. Create a new CloudFormation stack in your AWS account
  3. Paste the template and set your bucket name parameter
  4. Deploy the stack

​
Option 2: Manual Setup

If you prefer manual configuration, you can create the required IAM role and policies yourself:
Important: The IAM role MUST be named exactly cloudglue-external-s3-access-role or the connector will not work.
To create the role:
  1. Navigate to the IAM console
  2. Click on the Roles, under Access management
  3. Click on the Create role button
  4. Select AWS account as the trusted entity
  5. Under An AWS Account select Another AWS account and enter our account ID: 992382634011 AWS Role Step 1
  6. Under Add Permissions, click Next
  7. Enter the following as the role name: cloudglue-external-s3-access-role
  8. Click on the Create role button
Add the following policies to the role:
  • Add an inline policy to the role with the following JSON:

​
Role Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountRoleReadAccess",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ]
    },
    {
      "Sid": "AllowCrossAccountRoleWriteAccess",
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": [
        "arn:aws:s3:::cloudglue-external-transfer",
        "arn:aws:s3:::cloudglue-external-transfer/*"
      ]
    }
  ]
}
Remember to replace YOUR_BUCKET_NAME with your actual S3 bucket name in the manual policy setup.

​
Trust Relationship

The trust relationship is already attached to the role, so you can skip this step. 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::992382634011:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "ID_YOU_GENERATE"
        }
      }
    }
  ]
}
Want to learn more about trust relationships? See the AWS documentation on trust policies with IAM roles. Need help with CloudFormation templates? Check out the AWS CloudFormation Templates resources.

​
Connecting to Cloudglue

  1. Set up the IAM role using either the CloudFormation template or manual setup
  2. Get the role ARN from your AWS account
For CloudFormation Role ARN with CloudFormation For manual IAM setup Role ARN with manual setup
  1. Configure the connector on our web platform with the role ARN
S3 Connector Architecture
  1. Start using S3 URIs directly with Cloudglue endpoints
  2. Add the external ID that you used in the CloudFormation template or manual setup to the connector on our web platform. This adds an additional layer of security to the connector.
Ready to set up your data connector? Visit https://app.cloudglue.dev/data-connectors to configure your S3 connector.

​
Managing Access

You maintain full control over your data access. Remove this data connector by doing any of the following:
  • Revoke access by deleting the IAM role
  • Modify permissions by updating the role policies
  • Remove connection by revoking the connector on our website

​
Adding more buckets

If you need to add more buckets to the connector, you can do so by modifiying the policy attached to the role. All you need to do is add the new bucket to the Resource array. 
{
  "Action": [
    "s3:GetObject",
    "s3:ListBucket",
    "s3:GetBucketLocation"
  ],
  "Resource": [
    "arn:aws:s3:::YOUR_BUCKET_NAME",
    "arn:aws:s3:::YOUR_BUCKET_NAME/*",
    // Add more buckets here
    "arn:aws:s3:::YOUR_BUCKET_NAME2",
    "arn:aws:s3:::YOUR_BUCKET_NAME2/*"
  ],
  "Effect": "Allow",
  "Sid": "AllowCrossAccountRoleReadAccess"
},