--- title: "Setup guide" slug: "setup-guide-amazon-s3-source" updated: 2025-11-24T16:31:10Z published: 2025-11-24T16:31:10Z canonical: "bobsled.com/setup-guide-amazon-s3-source" --- > ## Documentation Index > Fetch the complete documentation index at: https://bobsled.com/llms.txt > Use this file to discover all available pages before exploring further. # Setup guide This article will describe the steps for a Provider to grant Bobsled access to an **Amazon S3 bucket** to be used as a source in Bobsled. --- ## Prerequisites - To configure Bobsled access to the bucket, your account must have **sufficient permissions** to **create policies** and **assign roles** in Amazon Web Services (AWS). --- ## Setup instructions Bobsled has created a cloud formation template that can be used to quickly create the role and trust policy required below. This saves time from having to create the policies manually and makes sure the policies are correctly configured. You can either: - **Use Bobsled Quick start AWS Cloud Formation Template** or, - **Create the IAM policies and roles** manually. ### Option 1: Quick start with AWS Cloud Formation Template Bobsled has created a cloud formation template that can be used to quickly create the role and trust policy required below. This saves time from having to create the policies manually and makes sure the policies are correctly configured. The path parameter is optional. If you want to filter Bobsled's access to a specific path, fill out the path parameter in the stack without leading or trailing slashes. If you want Bobsled to access the full bucket, leave this parameter empty. Click on the [Quick create stack ↗](https://console.aws.amazon.com/cloudformation/home?region=us-east-2#/stacks/quickcreate?templateUrl=https%3A%2F%2Fbobsled-cloud-formation-templates.s3.us-east-2.amazonaws.com%2FS3BucketSourceSetup.yaml&stackName=BobsledS3BucketSourceAccessSetup&param_BucketName=your-bucket-name&param_BobsledReadAccessRoleArn=bobsled-role-from-app&param_BobsledReadExternalId=bobsled-external-id-from-app&param_RoleName=BobsledAccessRole&param_TrustPolicyName=BobsledTrustPolicy&param_Path=optional_path_no_slash_before_or_after) in the AWS Console to get started. This link allows you to quickly configure and create the required permission for Bobsled. Alternatively, you can run the stack creation in the AWS CLI using the command below. ```plaintext ActionScriptActionScriptaws cloudformation create-stack --stack-name BobsledS3BucketSourceAccessSetup --template-url https://bobsled-cloud-formation-templates.s3.us-east-2.amazonaws.com/S3BucketSourceSetup.yaml --parameters ParameterKey=BucketName,ParameterValue=your-bucket-name ParameterKey=BobsledReadAccessRoleArn,ParameterValue=bobsled-role-from-app ParameterKey=BobsledReadExternalId,ParameterValue=bobsled-external-id-from-app ParameterKey=RoleName,ParameterValue=BobsledAccessRole ParameterKey=TrustPolicyName,ParameterValue=BobsledTrustPolicy ParameterKey=Path,ParameterValue=optional-path --region us-east-2 --capabilities CAPABILITY_NAMED_IAM ``` To complete the setup of the Source in the next step to configure your [Amazon S3 Source](/v2/docs/setup-guide-amazon-s3-source#last-step-finish-source-configuration-in-bobsled), you will need to obtain the `ARN` of the role created by the stack. You can access this information using the following CLI command. Ensure that the stack name matches the name you used. ```plaintext ActionScriptActionScriptaws cloudformation describe-stacks --stack-name BobsledS3BucketSourceAccessSetup ``` Alternatively, you can find the output role `ARN` by locating the stack in the [CloudFormation console ↗](http://console.aws.amazon.com/cloudformation/home/stacks). You can also see the stack template which includes the details on the policy and role that will be created by accessing the [template (.yaml) ↗](https://bobsled-cloud-formation-templates.s3.us-east-2.amazonaws.com/S3BucketSourceSetup.yaml) --- ### Option 2: Grant access to your bucket #### Step 1: Create an IAM Role 1. Login to **AWS Management Console**; 2. From the ‘Services’ dropdown, select **IAM** under the ‘**Security, Identity & Compliance**’ header'; 3. Click **Account Settings** on the left-hand panel; 4. Expand the ‘**Security Token Service (STS)**’ list, find the AWS region corresponding to the region where your bucket is located, and choose ‘**Activate**’ if the status is ‘**Inactive**’; 5. Click **Roles** on the left-hand panel; 6. Click the **Create role** button; 7. Under ‘Trusted entity type, select **Custom trust policy** 8. Set the trust policy using the following JSON: - Replace the `<awsBobsledReadArn>` and `<awsBobsledReadExternalId>` in the JSON below with the values found in the Bobsled application. These values can be found by visiting **Data Sources** > **Add Source** > select **Amazon S3.** ![Setting up an Amazon S3 source in the Bobsled Application](https://cdn.document360.io/87a415ff-4d6a-4c0c-adbb-26c563a2d9a8/Images/Documentation/Group 5.png) ```json {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": ""      },      "Action": "sts:AssumeRole",      "Condition": {        "StringEquals": {          "sts:ExternalId": ""        }      }    }  ] } ``` 9. Click the **Next** button; 10. Find the **policy you created in the previous section**, and select this policy; 11. Click the **Next** button; 12. Enter a name and description for the role, and click the **Create role** button; #### Step 2: Create an IAM Policy 1. Choose [**Policies ↗**](http://console.aws.amazon.com/iamv2/home#/policies) from the left-hand navigation pane; 2. Click **Create Policy**; 3. Click the **JSON** tab; 4. Add JSON policy that allows Bobsled to read from the S3 bucket. The following policies provide Bobsled with required permissions to read data from a specified list of **entire buckets** or **subfolders**. Please replace `placeholders` with your bucket name(s), and pay special attention to the trailing `/*`. It should be present on the first statement, but not on the second one; - Allow Bobsled to read from an entire bucket; ```json {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:GetObject",        "s3:GetObjectVersion"      ],      "Resource": [        "arn:aws:s3:::/*",        "arn:aws:s3:::/*"      ]    },    {      "Effect": "Allow",      "Action": [        "s3:ListBucket",        "s3:GetBucketLocation"      ],      "Resource": [        "arn:aws:s3:::",        "arn:aws:s3:::"      ]    }  ] } ``` - Allow Bobsled to read from subfolders within a bucket. ```json {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:GetObject",        "s3:GetObjectVersion"      ],      "Resource": [        "arn:aws:s3:::/*",        "arn:aws:s3:::/*"      ]    },    {      "Sid": "AllowListingOfSubFolder",      "Action": [        "s3:ListBucket",        "s3:GetBucketLocation"      ],      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::"      ],      "Condition": {        "StringLike": {          "s3:prefix": [            "subfolder/*"          ]        }      }    }  ] } ``` 5. Click **Next: Tags**; 6. Optionally add tags to the policy to help identify, organize, or search for AWS resources; 7. Create a policy name (e.g. bobsled_access), and optionally add a description; 8. Click **create policy**. 1. Record the Role ARN value located on the role summary page. You will use the Role ARN to configure your source in Bobsled. --- #### Step 3: For KMS Encrypted Buckets Only Grant Bobsled Role Access to Encryption Keys: 1. Navigate to the S3 bucket and click on **Properties** > **Default encryption** section. 2. Click the link for the **Encryption key ARN** 3. Copy the **Encryption Key ARN** and note it separately. 4. Click **Edit** to edit the policy - You will need to add the following inline to your key policy, replacing `<awsBobsledReadArn>` with the ARN Supplied in the Bobsled UI, and `<createdRoleARN>` with the ARN of the role you created for Bobsled: ```json {            "Sid": "Allow use of the key",            "Effect": "Allow",            "Principal": {                "AWS": [                    ""                ]            },            "Action": [                "kms:Encrypt",                "kms:Decrypt",                "kms:ReEncrypt*",                "kms:GenerateDataKey*",                "kms:DescribeKey"            ],            "Resource": "*"        },        {            "Sid": "Allow attachment of persistent resources",            "Effect": "Allow",            "Principal": {                "AWS": [                    ""                ]            },            "Action": [                "kms:CreateGrant",                "kms:ListGrants",                "kms:RevokeGrant"            ],            "Resource": "*",            "Condition": {                "Bool": {                    "kms:GrantIsForAWSResource": "true"                }            }        } ``` 5. Navigate to the **Policy** your created in Step 1. 6. Add the following inline to the policy, replacing `<kms_key_arn>` with the ARN of the S3 bucket key.: ```json {            "Effect": "Allow",            "Action": [                "kms:decrypt",                "kms:encrypt"            ],            "Resource": ""        } ``` --- ### Last step: Finish source configuration in Bobsled Once you have created the relevant roles and access policies, finish granting Bobsled access via the Bobsled app: 1. From the menu on the left, select **Data Sources**. 2. Click **Add Source** 3. Enter a human readable **name** to describe the source. 4. Select **Amazon S3** and the **region of your source bucket**. 5. Click **Continue** to move to the next step. ![](https://cdn.document360.io/87a415ff-4d6a-4c0c-adbb-26c563a2d9a8/Images/Documentation/s3.png) 6. Enter the `Read-only ARN` that you have created in the AWS Console. 7. Enter the `name` of the bucket. (Optionally, you may also include the path to the root of your source.) 8. Click **Save**. --- Once you’ve successfully configured your Source, you can add it to a [Share](https://docs.bobsled.co/docs/configure-share), choose a [Destination](/v2/docs/destinations), and a [create a transfer](/v2/docs/transferring-data) to start sharing your data.