Overview

Use Access Key authentication to let CleverTap read from or write to your Amazon S3 bucket. CleverTap authenticates with the Access Key ID and Secret Access Key of an AWS IAM user that you create for this purpose. This method works for both import and export connections.

Prerequisites

Ensure the following before proceeding:

• An S3 bucket has already been created on AWS. For more information, refer to Create S3 Bucket on AWS.

• The bucket details entered on the CleverTap dashboard with Access Key selected. For more information, refer to Add Bucket on CleverTap Dashboard.

• AWS console access with permissions to create IAM policies, IAM users, and access keys.

Configure with Access Key

Setting up Amazon S3 for Access Key authentication requires an IAM policy, an IAM user with that policy attached, and an access key for the user.

The setup has four parts:

1. Create IAM policy.
2. Create IAM User and Attach Policy.
3. Generate Access Key for User.
4. Configure Connection on CleverTap.

If you already have an IAM user for CleverTap, skip to Use Existing AWS Credentials.

Create IAM Policy

The IAM policy defines the S3 permissions that CleverTap needs on your bucket. For more information about AWS IAM, refer to Creating IAM policies on Amazon S3 Dashboard.

1. Log in to your AWS console and go to Identity and Access Management (IAM).

   

2. Select Policies from the left navigation and click Create policy.

   

3. Select the JSON tab and paste the policy for your use case into the editor.

4. Replace bucket-name with the name of your S3 bucket.

   JSON

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:ListBucket"
               ],
               "Resource": [
                   "arn:aws:s3:::bucket-name",
                   "arn:aws:s3:::bucket-name/*"
               ]
           }
       ]
   }

5. Click Next.

   

6. Enter a name for your policy under Policy name and click Create policy.

Create IAM User and Attach Policy

This section covers creating an IAM user for CleverTap and attaching the policy you created.

To create the user, perform the following steps:

1. Select IAM users from the left navigation and click Create user.

   

2. Enter the User name and click Next. Do not select Provide user access to the AWS Management Console; CleverTap only needs programmatic access.

   

3. Search for the policy you created and select it, and click Next.

   

4. Click Create user.

   

Generate Access Key

This section covers how to generate an access key that CleverTap uses to authenticate.

1. Open the user you just created in the Users list, and select the Security credentials tab.
2. Under Access keys, click Create access key.

3. Under Use Case, select Third-party service. Under Confirmation, select I understand the above recommendation and want to proceed to create an access key, then click Next.

   

4. (Optional) Enter a Description tag value, for example, CleverTap S3 export.

5. Click Create access key.

   

6. Copy the Access Key and Secret Access Key values. You will need these to configure the connection on CleverTap.

Use Existing AWS Credentials

If you already have an IAM user for CleverTap, verify its permissions and retrieve or rotate its access key.

Verify IAM User Permissions

This section covers how to find an existing access key or generate a new one if you have not stored the Secret Access Key.

Open the IAM user that CleverTap uses and select the Permissions tab.

To ensure CleverTap can access your S3 bucket, verify that the IAM user has at minimum the following permissions:

1. Open the user from the Users list and select the Permissions tab.
2. Confirm that an attached policy grants at least the actions listed below. If not, create the policy and attach it. Replace bucket-name with your actual bucket name.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}

Retrieve or Rotate Access Key

Find an existing access key, or create a new one if you did not store the Secret Access Key.

1. Select the Security credentials tab and scroll to Access keys.
2. If an active access key exists and you have its Secret Access Key stored, note the Access Key ID and continue to Configure Connection on CleverTap.
3. If you did not store the Secret Access Key, click Create access key, then follow steps 3 through 6 of Generate Access Key.

Configure Connection on CleverTap

Once your AWS credentials are in place, return to the CleverTap dashboard to complete the connection.

1. Return to the CleverTap dashboard. For import, go to Settings > Partners > Import center and select Amazon S3 connection. For export, go to Settings > Partners > Export center, select Amazon S3 connection.

2. Select Amazon S3, open your connection, and click Edit. The Edit Amazon S3 Connection page opens.

3. Select the Security credentials tab for the IAM user, then scroll down to Access keys.

4. Enter the Access key ID from AWS in Access Key and the Secret access key in Secret Key

   

5. Verify and save:

   • For import, click Test Connection. When the test succeeds, click Save.
   • For export, click Save. When you click Save, CleverTap uploads a test file to the specified bucket and region to verify the configuration. The configuration is saved only if the test file upload succeeds.

The Amazon S3 bucket is now configured on both the AWS console and the CleverTap dashboard.

Troubleshooting

Verification Checklist

Confirm the following before using the connection in production:

• The IAM policy contains only the actions required for the connection type (read for import, write for export).
• The policy's Resource values reference the correct bucket, with /* for object-level actions.
• The IAM user has no console access and no permissions beyond this policy.
• The Secret Access Key is stored in your organization's secrets manager.
• Test Connection (import) or Save (export) succeeded on the CleverTap dashboard.