---
title: "AWS Cross Account Integration"
slug: "aws-cross-account-integration"
updated: 2026-10-15T05:45:08Z
published: 2026-10-15T05:45:08Z
canonical: "docs.dataloop.ai/aws-cross-account-integration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cross Account Integration

## Overview

AWS Cross-Account Integration in the DDOE platform enables secure access to AWS resources across different accounts. This integration allows users to efficiently share and manage resources between their AWS accounts and DDOE, enhancing collaboration and operational efficiency.

> [!WARNING]
> Important
> 
> - We recommend selecting **Cross-Account** as the integration type. It is AWS’s most secure option and provides enhanced protection for your data.
> - Organizations can create up to 15 Cross Account integrations. To increase the number of Cross Account integrations for your organization, please contact our [Customer support](https://dataloop.ai/salesforce-form/) team.
> - Who can create?: Only users with the Organization **Admin** or **Owner** roles are authorized to create integrations. [Learn more](https://docs.dataloop.ai/docs/org-members-groups#org-role-permissions)

The AWS cross-account integration process involves:

## 1. Create an S3 Bucket

1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. Go to Services > Storage and click the **S3** service.
3. Click **Create bucket**. The Create Bucket page is displayed.
4. Provide a Bucket name.
5. Select your AWS region from the list.
6. Ensure you block public access settings for this bucket - **Block all public access**.
7. For all other optional settings, use the default values.
8. Click **Create bucket**. A confirmation message is displayed.

For a step-by-step guide on creating an S3 bucket in AWS, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html).

## 2. Create an IAM Policy

1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. Go to **Services** and click **All services**. A list of services is displayed.
3. Select the **IAM** service from the list.
4. Click on **Policies** from the left navigation panel.
5. Click **Create policy**. The Create Policy page is displayed.
6. Select the **JSON** tab and define the policy document in the following JSON format:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<DataloopBucketName>",
                "arn:aws:s3:::<DataloopBucketName>/*"
            ]

        }
    ]
}
```

          Note:

          

Replace `&lt;DataloopBucketName&gt;` with the name of the your S3 bucket.

1. Click **Next**.
2. Enter a **Name** for the policy and an optional **Description**.
3. Click **Create policy**. A confirmation message is displayed.

          Note:

          

- `s3:DeleteObject` action allows Dataloop platform to delete dataset items,  see [downstream](https://dataloop.ai/docs/storage?highlight=external%20sto#downstream).
- The resource `arn:aws:s3:::&lt;DataloopBucketName&gt;` is required for the `ListBucket` action.

For a step-by-step guide on creating an IAM policy in AWS, see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html).

S3 Restricted Folder Access

In a case you want to restrict your IAM policy further, please take a look at [S3 Restricted Folder Access](https://docs.dataloop.ai/docs/aws-restricting-access-to-specific-folder-in-s3).

## 3. Create an IAM Role

1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. Go to **Services** and click **All services**. A list of services is displayed.
3. Click the **IAM** service from the list.
4. From the left portal menu, click **Roles**.
5. Click **Create role**.
6. Choose **AWS service** as the trusted entity type.
7. Choose **EC2** as the use case.
8. Click **Next**.
9. Search and select the policy that you created for accessing the S3 bucket.
10. Click **Next**.
11. Enter a **name**  and an optional **description** for the role.
12. Click **Create role**. A confirmation message is displayed.
13. Click the **Role** that you created from the list.

          Note:

          

- Copy the **ARN** value, which is required during the integration phase.
- For a step-by-step guide on creating an S3 bucket in AWS, see [Creating IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html).

## 4. Start the AWS Cross Account Integration

Who can create?

Only users with the Organization **Admin** or **Owner** roles are authorized to create integrations. [Learn more](https://docs.dataloop.ai/docs/org-members-groups#org-role-permissions)

1. Log in to the DDOE platform.
2. From the left-side panel, select **Integrations**.
3. Click **Create Integration** -> **Create Storage Integration**. A pop-up window is displayed on the right-side.

![](https://cdn.document360.io/53f32fe9-1937-4652-8526-90c1bc78d3f8/Images/Documentation/integrations_create_aws_ca.png)

1. **Integration Name**: Enter a **Name** for the integration.
2. **Provider**: Select **AWS** from the list.
3. **Integration Type**: Select the **Cross Account** from the list.
4. Select an existing IAM user or get a new IAM user:
  1. **Get New IAM User**: Click on the Get New IAM User.

![](https://cdn.document360.io/53f32fe9-1937-4652-8526-90c1bc78d3f8/Images/Documentation/integrations_create_aws_ca_new_iam.png)
    1. **IAM User ARN**: A new IAM User ARN will be created and available to copy it.
    2. **IAM Role ARN**: Enter your Role ARN details.
  2. **Existing IAM User**: Click on the Existing IAM User.

Existing IAM User

If you have created one already, you can choose it from the list of IAM users that have not been assigned to an integration.

![](https://cdn.document360.io/53f32fe9-1937-4652-8526-90c1bc78d3f8/Images/Documentation/integrations_create_aws_ca_existing_iam.png)
    1. **IAM User ARN**: Select an IAM User ARN from the list and copy it.
    2. **IAM Role ARN**: Enter your Role ARN details.
5. **Copy** the IAM user's ARN and add the IAM user ARN to your [IAM Role trust relationship](/docs/aws-cross-account-integration#grant-dataloop-iam-user-access-to-an-iam-role).
6. Once added, click **Create Integration**.

## 5. Grant DDOE IAM User Access to an IAM Role

1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. Go to **Services** and click **All services**. A list of services is displayed.
3. Select the **IAM** service from the list.
4. Click **Roles** from the left navigation panel.
5. Choose and click on the role which you recently created.
6. Click on **Trust relationship** tab.
7. Click **Edit trust policy**.
8. Define the Trust relationship document in JSON format as follows:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<Dataloop_Account_Id>:user/<Dataloop_IAM_User>"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

1. Replace the AWS principal with the IAM user ARN you copied from the DDOE platform.
2. Click **Update policy**.

For a step-by-step guide on editing an IAM role trust relationship in AWS, see [Editing the trust relationship for an existing role](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html).

## 6. Complete the AWS Cross Account Integration

1. Log in to the DDOE platform.
2. Under the **Role ARN** field, enter the **ARN** of the IAM role for which you edited the Trust relationship.
3. Click **Create**. A confirmation message is displayed.