---
title: "AWS Assume Role"
slug: "aws-assume-role"
updated: 2026-07-14T16:46:48Z
published: 2026-07-14T16:46:48Z
canonical: "docs.dataddo.com/aws-assume-role"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataddo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Assume Role

Connect Dataddo to your AWS resources through an IAM role instead of access keys. You create a role in your own AWS account, allow Dataddo's AWS account to assume it, and Dataddo obtains short-lived credentials from AWS STS on every use - no long-lived keys are ever exchanged or stored.

## Prerequisites

- An AWS account with permissions to create IAM policies and roles.
- The name of the S3 bucket (or other AWS resource) you want to connect.

## Step 1: Create an IAM policy

1. Open the [Amazon IAM console](https://console.aws.amazon.com/iam/home#home).
2. Go to **Policies** and click **Create policy**.
3. Select the **JSON** tab and paste the following policy. Replace `{your-bucket-name}`  

with the name of your bucket:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::{your-bucket-name}",
                "arn:aws:s3:::{your-bucket-name}/*"
            ]
        }
    ]
}
```

> Keep only the actions you need: `s3:GetBucketLocation`, `s3:GetObject` and `s3:ListBucket` when Dataddo reads from the bucket (source), `s3:PutObject` and `s3:ListBucket` when Dataddo writes to it (destination). If the bucket is encrypted with a customer-managed KMS key, also allow `kms:Decrypt` (source) or `kms:GenerateDataKey` (destination) on that key.

1. Click **Next**, name the policy (for example `dataddo-s3-access`), and create it.

## Step 2: Find your External ID

In Dataddo, open **Authorizers**, click **Authorize new service**, and choose **AWS Assume Role**. The form shows your **External ID** - it is generated automatically, unique to your Dataddo account, and never changes. Keep this form open; you will need the External ID in the next step and the Role ARN at the end.

## Step 3: Create an IAM role

1. In the IAM console, go to **Roles** and click **Create role**.
2. Select **AWS account** as the trusted entity type, choose **Another AWS account**,  

and enter Dataddo's account ID: `815682785021`.
3. Check **Require external ID** and enter the External ID from Step 2.
4. Click **Next** and attach the policy you created in Step 1.
5. Name the role (for example `dataddo-access`) and create it.
6. Open the role's summary page and copy its **Role ARN**  

(it looks like `arn:aws:iam::123456789012:role/dataddo-access`).

The resulting trust policy looks like this:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::815682785021:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "{your-external-id}"
                }
            }
        }
    ]
}
```

## Step 4: Finish the setup in Dataddo

Back in the Dataddo form, paste the **Role ARN** and click **Save**. Dataddo immediately performs a test AssumeRole call, so a misconfigured trust policy or External ID is reported right away.

You can now select this authorizer when creating an S3 source or destination. The bucket name, region, and path are configured on the source/destination itself.