STS Integration

AWS STS (Security Token Service) Integration allows the Dataloop platform to securely assume AWS roles and obtain temporary security credentials for accessing AWS resources. This integration enhances security by providing time-limited access to AWS services and resources without the need to manage long-term access keys.

To set up STS in AWS and connect it to Dataloop, follow these instructions:

Create an S3 Bucket

Create an IAM Policy

Create an IAM User

1. Log in to the AWS Management Console.
2. Go to Services and click All services. A list of services is displayed.
3. Click the IAM service from the list.
4. From the left portal menu, click Users.
5. Click Add users.
6. Enter a username.
7. Ensure the Programmatic access checkbox is selected as the type of access you want to grant the user.
   Note: Use the default access type and do not choose console access.
8. Click Next. A Set Permissions page is displayed.
9. Leave the page as is and click next.
10. Click Create user. A confirmation message is displayed.
    See Creating an IAM user in AWS for more information.

Create an IAM Role

Add an Inline IAM policy to the IAM User

1. Log in to the AWS Management Console.
2. Go to Services and click All services. A list of services is displayed.
3. Click the IAM service from the list.
4. From the left portal menu, click Users.
5. Search and select the IAM user you just created.
6. Click on the Permissions tab
7. Click on the Add permissions button and choose Create inline policy
8. Select the JSON tab
9. Define policy document in JSON format, like:

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::<YourAWSAccountId>:role/<IAMRoleName>"
  }
}

10. Click Review Policy.
11. Enter a Name for the policy.
12. Click Create policy. A confirmation message is displayed.

Create an Access Key for the IAM User

Update the trust relationship of an IAM Role

1. Log in to the AWS Management Console.
2. Go to Services and click All services. A list of services is displayed.
3. Click the IAM service from the list.
4. From the left portal menu, click Roles.
5. Search and select the IAM role whose trust relationship you want to change.
6. Click the Trust relationships tab.
7. Click Edit trust policy.
8. Replace the existing trust policy JSON document with the following:

{    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                 "AWS":"arn:aws:iam::<AWSAccountId>:user/<IAMUserName>"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

6. Click Update Policy. A confirmation message is displayed.

Create an AWS STS Integration on Dataloop Platform

1. Log in to the Dataloop platform.
2. From the left-side panel, select Data Governance.
3. Click Create Integration. A pop-up window is displayed on the right-side.
4. Integration Name: Enter a Name for the integration.
5. Provider: Choose AWS from the list.
6. Integration Type: Select the STS from the list.
7. Key: Enter the IAM user’s access key ID that you noted while creating an access key for the IAM user.
8. Secret: Enter the IAM user’s secret access key that you noted while creating an access key for the IAM user.
9. Role ARN: Enter the Role ARN that you noted earlier.
10. Click Create Integration. A confirmation message is displayed.

Create S3 Storage Service on the Dataloop Platform

For more information, see the Create AWS S3 Storage Driver on the Dataloop Platform topic.