Amazon S3 Connector Setup Guide

Batch limits

This connector uses batched requests to support high-volume data transfers to the vendor. For more information, see Batched Actions. Requests are queued until one of the following thresholds is met or the profile is published:

• Maximum number of requests: 100,000
• Maximum time since oldest request: 10 minutes
• Maximum size of requests: 100 MB

Configuration

Go to the Connector Marketplace and add a new connector. For general instructions on how to add a connector, see About Connectors.

After adding the connector, configure the following settings:

• Authentication Type
  • Select the authentication type. Available options are: STS and Access Key.
    • STS: Requires Assume Role: ARN and Assume Role: Session Name fields.
    • Access Key: Requires AWS Access Key and AWS Secret Access Key fields.
• Region
  • (Required) Select a region.
• STS - Assume Role: ARN
  • Required for STS authentication. Provide the Amazon Resource Name (ARN) of the role to assume.
  • For example, arn:aws:iam:222222222222:role/myrole.
  • For more information, see AWS Identity and Access Management: Switch to an IAM role (AWS API).
• STS - Assume Role: Session Name
  • The name of the session for the role to assume.
  • Must be between 2 and 64 characters.
• STS - Assume Role: External ID
  • Provide a third-party external identifier.
  • For more information, see AWS Identity and Access Management: Access to AWS accounts owned by third parties.
• Access Key - AWS Access Key
  • Required for Access Key authentication. Provide the AWS access key.
• Access Key - AWS Secret Access Key
  • Required for Access Key authentication. Provide the AWS secret access key.

Create a connection to AWS S3

Tealium requires a connection to an AWS S3 instance to display a list of buckets and upload event and audience data into S3 objects. You have two options for authentication:

• Provide an Access Key and Access Secret.
• Provide STS (Security Token Service) credentials.

If the S3 objects are encrypted, you will need to add decrypt permission to the IAM user and KMS key policy.

Access Key and Secret credentials

To find your AWS Access Key and Secret:

1. Log in to the AWS Management Console and go to the IAM (Identity and Access Management) service.
2. Click Users and then click Add user.
3. Enter a username. For example, TealiumS3User.
4. Attach policies to the user you have just created.
   1. In the Permissions tab, click Attach existing policies directly.
   2. Search for and attach the AmazonS3FullAccess policy for full access. To restrict access to a specific bucket, create a policy similar to the following example. In the example, YOUR_BUCKET_NAME is the bucket that Tealium would use to upload event and audience data into S3 objects:

   {
     "Version": "2012-10-17",
     "Statement": [
         {
               "Effect": "Allow",
               "Action": [
                  "s3:ListBucket",
                   "s3:PutObject",
                   "s3:GetObject",
                   "s3:ListBucketMultipartUploads",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::YOUR_BUCKET_NAME",
                   "arn:aws:s3:::YOUR_BUCKET_NAME/*"
               ]
           },
           // Add the following section if you are running on a private cloud
           // and require decryption
           {
               "Effect": "Allow",
               "Action": [
                    "kms:Decrypt",
                    "kms:GenerateDataKey"
               ],
                "Resource": "arn:aws:kms:YOUR_REGION:111879511226:key/YOUR_KEY_ID"
          }
       ]
   }
   

5. Create the keys.
   1. Go to the Security credentials tab and click Create Access Key.
   2. Copy the Access Key ID and Secret Access Key, and save them securely.
   3. If you are using a private cloud environment, add a statement to your key policy similar to the following:

   {
       "Sid": "AllowDecryptFromIAMUser",
       "Effect": "Allow",
       "Principal": {
           "AWS": "arn:aws:iam::<<account-id>>:user/<<user-name>>"
       },
       "Action": [
           "kms:Decrypt",
           "kms:GenerateDataKey"
       ],
       "Resource": "*"
   }
   

STS credentials

To find your STS credentials:

1. Log in to the AWS Management Console and go to the IAM (Identity and Access Management) service.
2. Click Roles and then click Create role.
3. For the Trusted entity type, select the AWS account.
4. Select Another AWS account and enter the Tealium account ID:
   • For private cloud customers, the ID is 111879511226.
   • For all other customers, the ID is 757913464184.
5. (Optional) Select the Require external ID checkbox and specify the external ID that you want to use. External IDs can be up to 256 characters long and can include alphanumeric characters (A-Z, a-z, 0-9) and symbols, such as hyphens (-), underscores (_), and periods (.).
6. Enter a name for the role. The role name must start with TealiumS3. For example: TealiumS3-test.
7. Attach policies to the role.
   1. In the Permissions tab, click Attach existing policies directly.
   2. Search for and attach the AmazonS3FullAccess policy for full access. To restrict access to a specific bucket, create a policy similar to the following example. In the example, YOUR_BUCKET_NAME is the bucket that Tealium would use to upload event and audience data into S3 objects:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket",
                   "s3:PutObject",
                   "s3:GetObject",
                   "s3:ListBucketMultipartUploads",
                   "s3:ListMultipartUploadParts"
               ],
               "Resource": [
                   "arn:aws:s3:::YOUR_BUCKET_NAME",
                   "arn:aws:s3:::YOUR_BUCKET_NAME/*"
               ]
           },
           // Add the following section if you are running on a private cloud
           // and require decryption
           {
               "Effect": "Allow",
               "Principal": {
               "AWS": "arn:aws:iam::111879511226:user/YOUR_USER_NAME"
            },
               "Action": "s3:GetObject",
               "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
           }
       ]
   }
   

8. Create a trust policy.
   1. Go to the Trust relationships tab and click Edit trust relationship.
   2. Ensure that the trust policy allows the specific external ID to use the role you created and that for private cloud customers, the ID is 111879511226, and for all other customers, the ID is 757913464184.
   3. Set the EXTERNAL_ID value for the connection to Tealium. The ID can be up to 256 characters long and can include alphanumeric characters (A-Z, a-z, 0-9) and symbols, such as hyphens (-), underscores (_), and periods (.).

       {
           "Version": "2012-10-17",
           "Statement": [
               {
                   "Effect": "Allow",
                   "Principal": {
                       "AWS": "arn:aws:iam::757913464184:root"
                   },
                   "Action": "sts:AssumeRole",
                   "Condition": {
                       "StringEquals": {
                           "sts:ExternalId": "EXTERNAL_ID"
                       }
                   }
               }
           ]
       }
   

Create a bucket

An S3 bucket is a storage container within AWS S3 used to store and organize data. In the connector configuration window, you can create a new bucket by clicking Create Bucket in the configuration step.

1. In the connector configuration screen, click Create Bucket.
2. Enter the bucket name.
3. Click Create.

Actions

Enter a name for the action and select the action type from the drop-down menu.

The following section describes how to set up parameters and options for each action.

Send Entire Event Data

Parameters

Send Custom Event Data

Parameters

Message Data

Send Entire Visitor Data

Parameters

Send Custom Visitor Data

Parameters

Message Data

Send Log Event

Parameters

Message Data

Send Entire Log Event

Parameters