Creating a data grant on AWS Data Exchange containing Amazon S3 data access

Prerequisites

• Confirm that the Amazon S3 buckets hosting the data are configured with the Amazon S3 bucket owner enforced setting turned on ACLs Disabled. For more information, see Controlling ownership of objects and disabling ACLs for your bucket in the Amazon Simple Storage Service User Guide.

• Your shared objects must be in the Amazon S3 Standard Storage class, or be managed using Amazon S3 Intelligent Tiering, for recievers to access them successfully. If they’re in other storage classes, or if you have enabled Intelligent Tiering with Deep Archive, your receivers will get errors because they won’t have permission to RestoreObject.

• Confirm that the Amazon S3 buckets hosting the data has encryption disabled or encrypted with Amazon S3 managed keys (SSE-S3) or customer managed keys stored in AWS Key Management Service (AWS KMS).

• If you're using customer managed keys, you must have the following:

  1. IAM permissions to kms:CreateGrant on the KMS keys. You can access these permissions through the key policy, IAM credentials, or through an AWS KMS grant on the KMS key. For more information about key management and understanding how AWS Data Exchange uses AWS KMS grants, see Creating AWS KMS grants.

     To provide access, add permissions to your users, groups, or roles:

     • Users and groups in AWS IAM Identity Center:

       Create a permission set. Follow the instructions in Create a permission set in the AWS IAM Identity Center User Guide.

     • Users managed in IAM through an identity provider:

       Create a role for identity federation. Follow the instructions in Create a role for a third-party identity provider (federation) in the IAM User Guide.

     • IAM users:

       • Create a role that your user can assume. Follow the instructions in Create a role for an IAM user in the IAM User Guide.

       • (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in Adding permissions to a user (console) in the IAM User Guide.

     Users need programmatic access if they want to interact with AWS outside of the AWS Management Console. The way to grant programmatic access depends on the type of user that's accessing AWS.

     To grant users programmatic access, choose one of the following options.

     Which user needs programmatic access?	To	By
     Workforce identity (Users managed in IAM Identity Center)	Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions for the interface that you want to use. For the AWS CLI, see Configuring the AWS CLI to use AWS IAM Identity Center in the AWS Command Line Interface User Guide. For AWS SDKs, tools, and AWS APIs, see IAM Identity Center authentication in the AWS SDKs and Tools Reference Guide.
     IAM	Use temporary credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions in Using temporary credentials with AWS resources in the IAM User Guide.
     IAM	(Not recommended) Use long-term credentials to sign programmatic requests to the AWS CLI, AWS SDKs, or AWS APIs.	Following the instructions for the interface that you want to use. For the AWS CLI, see Authenticating using IAM user credentials in the AWS Command Line Interface User Guide. For AWS SDKs and tools, see Authenticate using long-term credentials in the AWS SDKs and Tools Reference Guide. For AWS APIs, see Managing access keys for IAM users in the IAM User Guide.

     Following is an example JSON policy that shows how you could add to the key policy of the KMS key.

     
     {
           "Sid": "AllowCreateGrantPermission",
           "Effect": "Allow",
           "Principal": {
     "AWS": "<IAM identity who will call Dataexchange API>"             
           },
           "Action": "kms:CreateGrant",
           "Resource": "*"
     }
     

     The following policy shows an example policy addition for the IAM identity that is used.

     
     {
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Sid": "AllowCreateGrantPermission",
                 "Action": [
                      "kms:CreateGrant
                 ],
                 "Resource": [
                   <Enter KMS Key ARNs in your account>                
                 ]
             }
         ]
     }
     

     Note

     Cross account KMS keys are also permitted if the kms:CreateGrant permission on the KMS keys are obtained through the earlier step. If another account owns the key, you must have permissions on the key policy and your IAM credentials as detailed in the above examples.

  2. Make sure to use KMS keys to encrypt existing and new objects in the Amazon S3 bucket using the Amazon S3 bucket key feature. For more details, see Configuring S3 Bucket Keys in the Amazon Simple Storage Service User Guide.

     • For new objects added to your Amazon S3 bucket, you can set up Amazon S3 bucket key encryption by default. If existing objects have been encrypted without using the Amazon S3bucket key feature, these objects must be migrated to use the Amazon S3 bucket key for encryption.

       To enable the Amazon S3 bucket key for existing objects, use the copy operation. For more information, see Configuring an Amazon S3 bucket key at the object level using batch operations.

     • AWS managed KMS keys or AWS owned keys aren't supported. You can migrate from an unsupported encryption scheme to the ones currently supported. For more information, see Changing your Amazon S3 encryption at the AWS Storage Blog.

  3. Set the Amazon S3 buckets hosting the data to trust AWS Data Exchange owned access points. You must update these Amazon S3 bucket policies to give AWS Data Exchange permissions to create Amazon S3 access points and grant or remove subscribers' access on your behalf. If the policy statement is missing, you must edit the bucket policy to add the Amazon S3 locations to your data set.

     An example policy is shown below. Replace <Bucket ARN> with the appropriate value.

     {
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "*"
                 },
                 "Action": [
                     "s3:GetObject",
                     "s3:ListBucket"
                 ],
                 "Resource": [
                     "<Bucket ARN>",
                     "<Bucket ARN>/*"
                 ],
                 "Condition": {
                     "StringEquals": {
                         "s3:DataAccessPointAccount": [
                             "337040091392",
                             "504002150500",
                             "366362662752",
                             "330489627928",
                             "291973504423",
                             "461002523379",
                             "036905324694",
                             "540564263739",
                             "675969394711",
                             "108584782536",
                             "844053218156"
                         ]
                     }
                 }
             }
         ]
     }