# Configure S3 access permissions for an offline source
<a name="virtual-source-s3-permissions"></a>

When you create an offline source data provider, you provide an IAM role ARN (`S3AccessRoleArn`) that allows DMS Schema Conversion to read DDL scripts from your S3 bucket. DMS assumes this role to access the files at the S3 path you specify.

**To configure S3 permissions for an offline source**

1. Create an IAM role with a trust policy that allows the DMS service principal to assume it. Use the following trust policy:

   ```
   {
       "Version": "2012-10-17",		 	 	 
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "dms.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }
   ```

1. Attach a permissions policy to the role that grants read access to your S3 bucket. The role requires the following permissions:  
**Required S3 permissions**    
[See the AWS documentation website for more details](http://docs.aws.amazon.com/dms/latest/userguide/virtual-source-s3-permissions.html)
**Note**  
If your S3 bucket uses server-side encryption with AWS KMS (SSE-KMS), add `kms:Decrypt` permission for the KMS key to the IAM role. If your bucket uses default Amazon S3 managed encryption (SSE-S3) or is not encrypted, no additional permissions are needed.

   The following example policy grants these permissions scoped to a specific bucket and prefix:

   ```
   {
       "Version": "2012-10-17",		 	 	 
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "s3:GetObject",
               "Resource": "arn:aws:s3:::{{amzn-s3-demo-bucket}}/{{prefix}}/*"
           },
           {
               "Effect": "Allow",
               "Action": "s3:ListBucket",
               "Resource": "arn:aws:s3:::{{amzn-s3-demo-bucket}}"
           }
       ]
   }
   ```

   Replace {{amzn-s3-demo-bucket}} and {{prefix}} with your bucket name and the path to your DDL scripts.

1. When you create the offline source data provider, provide the role ARN as the `S3AccessRoleArn` parameter and the S3 location of your DDL scripts as the `S3Path` parameter.

**Note**  
The IAM role must be in the same AWS account as the DMS resources. Cross-account S3 access is not supported for offline source data providers.