Cloud Read/Write Permissions for AWS

Capella Analytics

reference

This page outlines the required read and write permissions when copying data to or from external cloud providers.

Exclusive permissions are required when reading from cloud storage using External Collections or writing to cloud storage using COPY TO statements.

Prerequisites

Before granting permissions, ensure you have the following:

An AWS account with the necessary administrative privileges.
Access to the AWS Management Console.
The name of the S3 bucket you want to access.

Read Permissions

You need Read permissions when reading from cloud storage using External Collections.

To create a policy and grant read permissions to your AWS S3 cloud storage:

Go to the AWS Console.
From the Dashboard, select IAM.
Select Policies.
Select Create Policy.
In the Policy Editor, select JSON.

Paste the following policy:

s3:ListBucket permission

s3:GetObject permission

  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::your-bucket-name"
        }
    ]
}

Give the policy a name and create the policy.
Attach the policy to the desired IAM User or Role.

It grants the selected permissions to the selected resources in the policy.

Read and Write Permissions

Read and write permissions are needed when writing to cloud storage using COPY TO statements.

To create a policy and grant read and write permissions to your AWS S3 cloud storage:

Go to the AWS Console.
From the Dashboard, select IAM.
Select Policies.
Select Create Policy.
In the Policy Editor, select JSON.

Paste the following policy:

s3:ListBucket permission
s3:GetObject permission
s3:PutObject permission
s3:DeleteObject permission

  {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::your-bucket-name"
        }
    ]
}

For AI agents:

Cloud Read/Write Permissions for AWS

Prerequisites

Read Permissions

Read and Write Permissions

See Also