Skip to main content

​
About Amazon Simple Storage Service (S3)

The Amazon S3 connector inventories bucket configuration: policies, encryption, versioning, logging, notifications, public-access blocks, and related settings without reading object payloads. Iru assumes an IAM role you create in your account (sts:AssumeRole with an external ID). This keeps evidence focused on how buckets are configured, not on stored file contents.

​
How It Works

Iru runs in its own AWS account. To inventory S3 bucket configuration (not object payloads by default), you create an IAM role whose trust policy references Iru’s AWS principal and mandates the External ID from the wizard, and whose permissions policy grants only the metadata reads your team approves. Prefer the inline policy below instead of AmazonS3ReadOnlyAccess alone. The managed policy includes s3:GetObject, which many teams disallow for metadata-only integrations. Paste the role’s ARN back into Iru.
DetailValue
CategoryObject storage
AuthenticationCross-account IAM role
References: S3 user guide, Access management.

​
Prerequisites

  • IAM rights to create roles and attach inline policies.
  • The live principal + external ID pair from your connector - not necessarily the sample IDs printed in older screenshots.

​
Connect Amazon S3 to Iru

Start here: open the source wizard and copy the trust policy (and note the external ID). When you are ready to create the role in AWS, switch to the AWS tab and follow Create the IAM role in AWS. After you have the Role ARN, return to the Iru Compliance tab and complete Submit the role ARN in Iru below.

​
Get the trust policy from Iru

1

Open Sources

In Iru Compliance, on the left navigation bar, expand Compliance and select Sources.
Left navigation: Compliance expanded, Sources selected
2

Turn on AWS S3

Find AWS S3 (use Category or Search by name or description). On that card, turn on the toggle. Leave the Iru is requesting access to external services wizard tab open.
3

Copy the trust policy JSON

The wizard shows the trust policy JSON your IAM role must use (Principal and sts:ExternalId). Below is an example of the structure; copy the live JSON from your wizard so the account, principal ARN, and external ID match exactly.
copy=false
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::753695775620:role/IruConnect"
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
4

Switch to AWS to create the role

Keep the Iru wizard tab open for reference, then switch to the AWS tab and follow Create the IAM role in AWS.

​
Submit the role ARN in Iru

Finish the AWS tab first (through Create the IAM role in AWS) so you have the Role ARN from the new role.
1

Paste the IAM Role ARN

Return to the Iru wizard tab. Paste the Role ARN where the connector prompts for it.
2

Finish the connection

Click Submit Role. When the connection succeeds, the wizard shows Connection Configured.
3

Confirm the source is Active

Close the Iru is requesting access to external services browser tab, then return to Compliance → Sources and confirm the AWS S3 card is Active.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
External ID mismatch - re-copy from Iru without stray spaces.
Bucket resource policies can deny cross-account reads even when IAM allows them.
Confirm s3:GetEncryptionConfiguration stayed in the inline policy.

​
Considerations

Buckets are regional, but ListAllMyBuckets is…

Buckets are regional, but ListAllMyBuckets is global - expect multi-Region follow-up calls during inventory.

Explicit Deny statements in bucket policies block…

Explicit Deny statements in bucket policies block reads regardless of IAM allows - document expectations with auditors.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.