AWS Assume Role

Connect Dataddo to your AWS resources through an IAM role instead of access keys. You create a role in your own AWS account, allow Dataddo's AWS account to assume it, and Dataddo obtains short-lived credentials from AWS STS on every use - no long-lived keys are ever exchanged or stored.

Prerequisites

• An AWS account with permissions to create IAM policies and roles.
• The name of the S3 bucket (or other AWS resource) you want to connect.

Step 1: Create an IAM policy

1. Open the Amazon IAM console.
2. Go to Policies and click Create policy.
3. Select the JSON tab and paste the following policy. Replace {your-bucket-name}
   with the name of your bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::{your-bucket-name}",
                "arn:aws:s3:::{your-bucket-name}/*"
            ]
        }
    ]
}

Keep only the actions you need: s3:GetBucketLocation, s3:GetObject and
s3:ListBucket when Dataddo reads from the bucket (source), s3:PutObject and
s3:ListBucket when Dataddo writes to it (destination). If the bucket is
encrypted with a customer-managed KMS key, also allow kms:Decrypt (source)
or kms:GenerateDataKey (destination) on that key.

4. Click Next, name the policy (for example dataddo-s3-access), and create it.

Step 2: Find your External ID

In Dataddo, open Authorizers, click Authorize new service, and choose AWS Assume Role. The form shows your External ID - it is generated automatically, unique to your Dataddo account, and never changes. Keep this form open; you will need the External ID in the next step and the Role ARN at the end.

Step 3: Create an IAM role

1. In the IAM console, go to Roles and click Create role.
2. Select AWS account as the trusted entity type, choose Another AWS account,
   and enter Dataddo's account ID: 815682785021.
3. Check Require external ID and enter the External ID from Step 2.
4. Click Next and attach the policy you created in Step 1.
5. Name the role (for example dataddo-access) and create it.
6. Open the role's summary page and copy its Role ARN
   (it looks like arn:aws:iam::123456789012:role/dataddo-access).

The resulting trust policy looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::815682785021:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "{your-external-id}"
                }
            }
        }
    ]
}

Step 4: Finish the setup in Dataddo

Back in the Dataddo form, paste the Role ARN and click Save. Dataddo immediately performs a test AssumeRole call, so a misconfigured trust policy or External ID is reported right away.

You can now select this authorizer when creating an S3 source or destination. The bucket name, region, and path are configured on the source/destination itself.