Prerequisites for Creating a Connection

You must satisfy the following prerequisites to create a connection with the Amazon Simple Storage Service (S3) Adapter:

Create an AWS Account

  1. Go to https://aws.amazon.com.
  2. Click Create an AWS Account.
  3. Enter a root user email address.
  4. Enter a name for your account in the AWS account name field.
  5. Click Verify email address.
  6. Once the email address is verified, create your root user password.
  7. In the subsequent steps, enter your contact information and billing information details.
  8. Complete the transaction to successfully create a root user account.

    You can now sign in to your AWS Account using the root user credentials.

    Note:

    The root user possesses unrestricted access to AWS resources. It is necessary to create an Oracle Identity and Access Management (IAM) user.

Create an Inline Policy

  1. Click IAM and select Policies under Access management.
  2. Select Attach policies directly on the Set permissions page.
  3. In the Permissions policies section, click Create policy.
  4. On the Specify permissions page that opens, select S3 as a Service.
  5. In the Actions allowed section, select the ListAllMyBuckets check box as the Access level for your resource in S3.

    Note:

    This is the minimum permission required for you to create the connection. You can add more permissions as per the actions you want to invoke. For example, if you want to create a bucket, the corresponding permission (create bucket) must be added to the new or existing policy.
  6. Click Next.
  7. Enter the policy name and click Create Policy.

    The newly created policy is added to the list on the Policies Page.

Create an Oracle IAM User and Obtain the Access Key and Secret Access Key

  1. Log in to an AWS account using the root user credential.
  2. In the search bar, enter IAM.
  3. Click IAM and select Users under Access management.
  4. Click Create user.
  5. Enter a name for the user and click Next.
  6. On the Set Permissions page that appears, perform the following:
    1. Select Attach policies directly as the Permissions Options.
    2. Select the permission policies that you created for this user and click Next. See Create an Inline Policy.
    3. (Optional step) Set a permissions boundary under Set permissions boundary, and click Next.
  7. (Optional step) Add tags to AWS resources.
  8. Click Create User.
  9. Navigate to Dashboard, then Access management, and then Users. The newly created user appears in the list.
  10. Select the user in the User name column.
  11. On the User Info page, select Create access key in the Summary section.
  12. Under Access key best practices & alternatives, select the use case according to your requirement, and click Next.
  13. (Optional step) Provide a description tag, if required, and click Next.

    The Access key created message appears.

    The Access Key and Secret Access Key are displayed.

  14. Copy the access key ID and secret key.

    Note:

    You must enter the access key in the Access Key field and the secret key in the Secret Access Key field on the Connections page. See Configure Connection Security.
  15. Alternatively, you can click Download .csv file to download a file that contains the access key ID and the secret key.
  16. Click Done.

Create a Role for an Oracle IAM User

  1. Create an Oracle IAM user. See Create an IAM User and Obtain the Access Key and Secret Access key.
  2. Return to Oracle IAM and in the left sidebar under Access management, click Roles.
  3. Click Create Role.
  4. Select AWS Account from the Trusted Entity Type list.
  5. Create a new permission using existing policies or create an inline policy (for example, AmazonS3FullAccess) for this role.
  6. Give the role a meaningful name and description.
  7. Click Create Role.

    A role is successfully created.

Edit Trust Relationships for a Role

  1. Browse Oracle IAM users from Access Management.
  2. Select the necessary Oracle IAM user.
  3. Copy the Amazon Resource Name (ARN) value from the Summary tab. You need the user ARN value to edit the trust relationship of a role.
  4. Navigate to Roles and select the role that you created for your Oracle IAM user.
  5. Go to the Trust Relationships tab.
  6. Edit the trust relationship by writing a JSON entry. For example:
    {
"Version": "2012-10-17",
"Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "ARN of IAM User " //Paste the ARN of IAM user which you have retrieved in steps mentioned above
 },
"Action": "sts:AssumeRole"
 }
]
}

Create Policies for a Role

  1. Go to Access Management, then Policies.
  2. Click Create Policy.
  3. Click JSON.
  4. Add a policy JSON here. The ARN used here is from the role. To retrieve it, navigate to Access Management, then Role, then summary, and then Role ARN. For example:
    • role-sts-policy
      {
   "Version": "2012-10-17",
   "Statement": [
 {
"Sid": "AllowAssumeSpecificRole",
"Effect": "Allow",
 "Action": "sts:AssumeRole",
 "Resource": "PASTE_ROLE_ARN_HERE" //role ARN u can get from role dashboard which u created
 }
   ]
}
    • user-sts-policy
      {
"Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "sts:AssumeRole",
 "Resource": "PASTE_ROLE_ARN_HERE"  //role ARN u can get from role dashboard which u created
       }
   ]
}
  5. Save the JSON file.

Configure the External ID for a Role

Follow these steps if you want to configure the external ID for a role.

  1. Navigate to Roles under Access Management and select the role you had created.
  2. Edit the existing trust relationship by adding the external ID as shown below. For example: 
    {
  "Version": "2012-10-17",
  "Statement": [
 {
"Effect": "Allow",
 "Principal": {
 "AWS": “ARN of IAM User " //Paste the ARN of IAM user which you had retrieved earlier
 },
 "Action": "sts:AssumeRole",
 "Condition": {
"StringEquals": {
 "sts:ExternalId": "give-meaningful-value-to-it-eg-OICEXT"
 }
 }
 }
  ]
}
  3. Click Update Policy.
    Your role is now configured to use the external ID.

    Note:

    Save the external ID. You need it on the Connections page.