Overview

The Syniti Knowledge Platform allows data generated from activities such as the execution of data quality implementations to be written to file-based data stores that our customers own and manage. Currently, the Syniti Knowledge Platform supports Amazon S3 Buckets and Microsoft Azure Store as options for data store types.

This article explains how to create an AWS S3 Bucket and register it as a data store in the Syniti Knowledge Platform.

Create and Register an Amazon S3 Data Store

This article contains the following sections:

• Prerequisites

• Create AWS S3 Bucket

• Create IAM Policy

• Create IAM Role

• Register AWS S3 Bucket in the Syniti Knowledge Platform

Prerequisites

Customers must have their own Amazon Web Services account and the user performing this task must have permissions to create S3 Buckets, IAM Policies and IAM Roles. 

Customers must raise a Synti Support ticket requesting the relevant regional Syniti AWS Account Number. This Account Number is required when creating the IAM Role as detailed later in this article.

Create AWS S3 Bucket

Refer to the Amazon Webservices Documentation Step 1 Create your first S3 bucket for comprehensive documentation related to the S3 Bucket creation:

To create the S3 Bucket:

1. Navigate to the S3 area of AWS:

   https://s3.console.aws.amazon.com/s3/

2. Click the Create bucket button.

   

3. Under General Configuration, enter a unique Bucket name.
4. Select the AWS region in which to create the S3 Bucket from the AWS Region list box.

   

5. Under Object Ownership, click the ACLs disabled option.

   

6. Under Block Public Access settings for this bucket, select the Block all public access option.

   

7. Under Bucket Versioning, click the Disable option.

   

8. Under Default Encryption, set the Encryption key type to Amazon S3-managed keys (SSE-S3).
9. Under Bucket Key, click the Disable option.

   

10. Under Advanced Settings, under Object Lock, click the Disable option.

    

Create IAM Policy

To create the IAM Policy:

1. Navigate to the IAM section of AWS and select Policies.
2. Click the Create Policy button.

   

3. Under Actions, under Access Level, under List, check the following options:

• ListBucket
• ListBucketMultipartUploads

  

  

4. Under Actions, under Access level, under Read, check the GetObject option.

   

5. Under Actions, under Access level, under Write, check these options. 

• AbortMultipartUpload
• PutObject

  

6. Under Resources, add the allowable Bucket that the Role can access by clicking the Add APN link.

   

7. Enter the Bucket name and click the Add button.

   

8. Under Resources, add the allowable Bucket Objects that the Role can access by clicking the Add APN link next to Object.

   

9. Enter the Bucket name.
10. Next to Object name, check the Any option.

    

11. Under Review Policy, enter a Name for the policy and click the Create policy button. 

    

Create IAM Role

1. Navigate to the IAM section of AWS, select Roles and click the Create role button.

   

2. On the Select trusted entity page, select the Custom trust policy option.

   

3. Under Add action for STS, check the AssumeRole option.

   

4. Next to Add a principal, click the Add button.

   NOTE: In this step, the Syniti AWS Account is added as a trusted Principal to the role.

   

5. Select AWS account and root user from the Principal type list box.

6. Enter the Syniti AWS Account number in the format arn:aws:iam::XXXXXXXXXXXX:root as provided to you by Syniti Support in the ARN field.

   NOTE: Refer to the Prerequisites section for more information about contacting support.

7. Next to Add a condition, click the Add button.

   NOTE: In this step, a secret pass phrase that the principal must use to access the
   Bucket is added.

   

   

8. Complete the fields as indicated by the screen shot above, and click the Add condition button.
9. Review the Customer Trust Policy. The custom policy JSON should look as follows, with the AWS Account number being replaced with the one provided by Syniti support and the sts:ExternalID being replaced with the secret pass phrase that you entered.

   

10. Under Add Permissions. give the Role permission to the Policy you previously created.

    

11. On the Name, review, and create page, provide the Role with a Name. 

    

12. Click Create Role.

Register AWS S3 Bucket in the Syniti Knowledge Platform

To register the Bucket in the Syniti Knowledge Platform:

1. Log in to the Syniti Knowledge Platform with an Administrator Account.
2. Navigate to Admin and select Data Store.

   NOTE: Only one data store can be registered at a time. If a data store is not registered, the page displays in Add mode. If a data store has already been added, it can be edited.

3. Click Edit Data Store.

   NOTE: For security reasons, none of the currently saved values display in the fields on this page, though they are saved in the database.

4. Select Amazon S3 from the Type list box.
5. Enter a Name for the Data Store.
6. Enter the AWS Account in which the S3 bucket was created in the External Account ID field.
7. Enter the Secret Pass Phase entered into the Role custom trust policy in the Passcode field.
8. Enter the Role ARN, stored in the Role properties.
9. Enter the exact name of the S2 Bucket in the Bucket field.
10. Enter the AWS region in which the bucket was created in the Region field. 
11. Click Save.