Articles in this section

Create an Amazon AWS iClient

Kathyana Queeman
Updated

Creating an Amazon Web Services (AWS) iClient allows you to secure and manage your Amazon connections quickly.

You can create an iClient at Resources → iClients or directly in an Amazon S3 connection.

Tip

Open your AWS Console in a separate window, so you can quickly generate, copy, and paste the required fields.

Setting

Description

Name *

Enter a clear and distinguishable name.

Celigo AWS account ID * (read-only)

Copy copy.svg​​ Celigo’s AWS account ID. You’ll need this value later to create an IAM role in your AWS account.

dataLoad.svg​​ Create an IAM role.

Role ARN *

After creating your IAM Role in AWS, copy the role's ARN and paste it here. Your role ARN’s name must begin with celigo-file-adaptor. For example, arn:aws:iam::1335:role/celigo-file-adaptor-s3-test.

Amazon Resource Names (ARNs) uniquely identify AWS resources. While ARNs, like any identifying information, should be used and shared carefully, they are not considered secret, sensitive, or confidential information.

dataLoad.svg​​ Retrieve your role's ARN.

External ID * (read-only)

Generate and copy copy.svg​​ the external ID unique to this iClient. You’ll need this value later to create an IAM role in your AWS account.

dataLoad.svg​​ Create an IAM role.
iclient.png

Create an IAM role

Before you begin, ensure your AWS account permissions allow you to create and modify IAM permissions policies and create and modify IAM roles.

Create an IAM role. When creating the role:

  1. Select Trusted entity type → AWS account.

    trusted_entity.png

  2. Select Another AWS account and paste Celigo's AWS account ID.

    aws_account.png

  3. Select Options → Require external ID and paste the external ID generated by Celigo.

    aws_account.png

  4. Add a Role name and description. This role's name must follow the following pattern: celigo-file-adaptor<Name>. You must prepend celigo-file-adaptor to your Role's name.

  5. Create inline policies to add to the role. The trust policy allows Celigo to assume the role. It does not grant access to S3. You can add policies via the console or using JSON:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:HeadBucket",
      "Resource": "arn:aws:s3:::<your-bucket>"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::<your-bucket>"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::<your-bucket>/*"
    }
  ]
}

  6. Copy your IAM role's ARN.

    role_arn.png

Retrieve your IAM role’s ARN

Find your IAM role's ARN.