You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/connections/functions/aws-apis.md
+20-25Lines changed: 20 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,41 +13,41 @@ To set up your functions to call AWS APIs:
13
13
2. Create an IAM role in your AWS account with the [minimum set of necessary permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege){:target="_blank"}.
14
14
3. Add a trust relationship to your role with the following policy, filling in the principal account ID and external ID from step 1.1:
15
15
```json
16
-
{
17
-
"Version": "2012-10-17",
18
-
"Statement": [
19
-
{
20
-
"Effect": "Allow",
21
-
"Principal": {
22
-
"AWS": "<PRINCIPAL_ACCOUNT_ID>"
23
-
},
24
-
"Action": "sts:AssumeRole",
25
-
"Condition": {
26
-
"StringEquals": {
27
-
"sts:ExternalId": "<EXTERNAL_ID>"
16
+
{
17
+
"Version": "2012-10-17",
18
+
"Statement": [
19
+
{
20
+
"Effect": "Allow",
21
+
"Principal": {
22
+
"AWS": "<PRINCIPAL_ACCOUNT_ID>"
23
+
},
24
+
"Action": "sts:AssumeRole",
25
+
"Condition": {
26
+
"StringEquals": {
27
+
"sts:ExternalId": "<EXTERNAL_ID>"
28
+
}
28
29
}
29
30
}
30
-
}
31
-
]
32
-
}
31
+
]
32
+
}
33
33
```
34
34
35
35
2. Create your function.
36
36
<br> Now that you have an IAM role in your AWS account, you can create your source or destination function. Segment recommends you to use function settings to make the IAM role configurable. This allows you to use different roles for different instances of your function and to securely store your external ID value by making it a "sensitive" setting. Here are the required settings:
37
37
* **IAM Role ARN**: A string setting that is the ARN for the IAM role above. For example, `arn:aws:iam::1234567890:role/my-secure-role`.
38
38
* **IAM Role External ID**: A sensitive string setting that is the external ID for your IAM role.
39
39
40
-
Below is an example destination function that uploads each event received to an S3 bucket (configured using an additional "S3 Bucket" setting). It uses the built-in local cache to retain S3 clients between requests to minimize processing time and to allow different instances of the function to use different IAM roles.
40
+
Below is an example destination function that uploads each event received to an S3 bucket (configured using additional "S3 Bucket" and "S3 Bucket Region" settings). It uses the built-in local cache to retain S3 clients between requests to minimize processing time and to allow different instances of the function to use different IAM roles.
0 commit comments