SSD Delivery via AWS S3 Bucket

Introduction

For Conviva SSD customers with AWS (Amazon Web Services ) S3 (Simple Storage Service) accounts, we support SSD file delivery to S3 buckets. The SSD files delivered to a customers' S3 bucket will be fully owned by the respective AWS account.

We currently support the following S3 bucket sharing options:

• S3 Bucket Policy

• S3 Bucket Policy with KMS Encryption

• AWS Roles

• AWS Roles with KMS Encryption

To ensure successful and secure transfer of the SSD files to the AWS S3 buckets, each option requires a different setup and configuration and different information exchange between a customer and Conviva. The following sections describe the setup steps for each option.

Using S3 Bucket Policy

S3 Bucket Policy

Please use the following steps to configure SSD delivery using an S3 bucket policy:

1. Log in to your AWS console.

2. Select S3 from AWS services list.

3. Select the SSD uploads bucket created by your AWS administrator (or create bucket if it's not already created).

4. Click Permissions.

5. Click Bucket Policy.

6. Put in the following policy in the policy area, after replacing <BUCKET_NAME> with the bucket name in step (c), and click Save.

{
    "Version": "2012-10-17",
    "Statement": {
                  "Effect": "Allow",
                  "Principal": {
                        "AWS": "arn:aws:iam::546944332888:root"
                  },
                      "Action": "s3:*",
                      "Resource": [
                            "arn:aws:s3:::<BUCKET_NAME>",
                            "arn:aws:s3:::<BUCKET_NAME>/*"
                      ]
      }
}

Please send the following details to Conviva customer support team through Pulse Portal Support page or email them to Conviva Support:

S3 Bucket Policy with KMS Encryption

1. Login to AWS console

2. Select IAM from AWS services list.

3. In the navigation pane on the left, choose Encryption keys

4. Select the region below the Create key button. The KMS key and the S3 bucket should be in the same region, so chose accordingly.

5. Click Create key now.

6. In Alias, enter "conviva-ssd-upload" and in Description, enter "KMS key for Conviva SSD upload in S3". Click Next Step at the bottom.

7. Add Tags if you want, else click Next Step at the bottom .

8. Add Key Administrators if you want, else click Next Step at the bottom .

9. In "Define Key Usage Permissions" page, scroll to the bottom of the page and click Add an External Account.

10. In account textbox, enter 546944332888 and Next Step at the bottom .

11. You can Preview Key Policy here and click Finish at the bottom.

12. Then open the newly created key and make note of the ARN.

13. Now Select S3 from AWS services .

14. Select the SSD uploads bucket created by your AWS administrator (or create bucket if it's not already created).

15. Click Permissions

16. Click Bucket Policy

17. Put in the below policy, after replacing <BUCKET_NAME> with the bucket name in step (n), in the policy area and click Save.
    

    {
        "Version": "2012-10-17",
        "Statement": {
                        "Effect": "Allow",
                        "Principal": {
                                        "AWS": "arn:aws:iam::546944332888:root"
                        },
                        "Action": "s3:*",
                        "Resource": [
                                        "arn:aws:s3:::<BUCKET_NAME>",
                                        "arn:aws:s3:::<BUCKET_NAME>/*"
                        ]
        }
    }

18. Go to Properties tab and click on Default Encryption

19. Select AWS-KMS and in the drop down menu select Custom KMS ARN

20. In the textbox below, enter the ARN you got in step #12 and click Save.

Please send the following details to Conviva customer support team through Pulse Portal Support page or email them to Conviva Support:

Using AWS Roles

AWS Roles

1. Login to the AWS console and select S3 from the AWS services list.

2. Select the SSD uploads bucket created by your AWS administrator.

3. Go to IAM from AWS services.

4. From the left navigation pane, choose Roles and then choose Create role.

5. Select the Another AWS account role type.

6. Enter the Account ID value as 546944332888 (Conviva's AWS Account) and select Require external ID.

7. Create a Trust Policy with a unique external ID, by using the following JSON:

   { 
       "Version": "2012-10-17", 
       "Statement": [ 
                      { 
                       "Effect": "Allow",
                       "Action": "sts:AssumeRole",
                       "Principal": { "AWS": "546944332888" 
                                     }, 
                       "Condition": { "StringEquals": 
                                  { "sts:ExternalId": "conviva101" } 
                                    } 
                       } 
                   ] 
   }

8. Choose Next: Permissions to set the permissions associated with the role and click Next: Review at the bottom and do not attach any policy.

9. Enter a Role name (as example, conviva-ssd-upload-role) and click Create role at the bottom. Your role is created.

10. Open the newly-created role and click Add inline policy in the Permissions tab.

11. Choose the JSON tab and copy the text from the following JSON policy document. Replace <BUCKET_NAME> with SSD uploads bucket name selected in step #3.
    

    {
        "Version": "2012-10-17",
        "Statement": {
                        "Effect": "Allow",
                        "Action": "s3:*",
                        "Resource": [
                                        "arn:aws:s3:::<BUCKET_NAME>",
                                        "arn:aws:s3:::<BUCKET_NAME>/*"
                        ]
        }
    }

12. Click Review policy at the bottom.

13. Give a Name for the policy (for example, access-to-s3-<BUCKET_NAME>) and click Create policy at the bottom.

14. Send the following details to Conviva customer support team through Pulse Portal Support page or email them to Conviva Support:

AWS Roles with KMS Encryption

1. Login to AWS console and select IAM from AWS services list.

2. In the navigation pane on the left, choose Encryption keys.

3. Select the region below the Create key button. The KMS key and the S3 bucket should be in the same region, so chose accordingly.

4. Click Create key.

5. In Alias field enter conviva-ssd-upload and in Description field enter KMS key for Conviva SSD upload in S3. Click Next Step.

6. Add Tags if you want, else click Next Step.

7. Add Key Administrators if you want, else click Next Step.

8. In the Define Key Usage Permissions page, click Next Step.

9. Preview the key policy and click Finish.

10. Open the newly created key and make note of the ARN.

11. Select S3 from AWS services.

12. Select the SSD uploads bucket created by your AWS administrator (or create bucket if it's not already created).

13. Goto Properties tab and click on Default Encryption

14. Select AWS-KMS and in the drop down menu select Custom KMS ARN

15. In the text box below, enter the ARN you got in step #10 and click Save.

16. Go to IAM from AWS services.

17. From the left navigation pane, choose Roles and then choose Create role.

18. Select the Another AWS account role type.

19. Enter the Account ID value as 546944332888 (Conviva's AWS Account) and select Require external ID.

20. Create a Trust Policy with a unique external ID, by using the following JSON:

    { 
        "Version": "2012-10-17", 
        "Statement": [ 
                       { 
                        "Effect": "Allow",
                        "Action": "sts:AssumeRole",
                        "Principal": { "AWS": "546944332888" 
                                      }, 
                        "Condition": { "StringEquals": 
                                   { "sts:ExternalId": "conviva101" } 
                                     } 
                        } 
                    ] 
    }

21. Choose Next: Permissions to set the permissions associated with the role.

22. Click Next: Review at the bottom and do not attach any policy.

23. Enter a Role name (as example, conviva-ssd-upload-role) and click Create role at the bottom. Your role is created.

24. Open the newly created role and click Add inline policy in the Permissions tab.

25. Choose the JSON tab and copy the text from the following JSON policy document. Replace <KMS_KEY_ARN> with ARN of KMS key created in step #10 and <BUCKET_NAME> with bucket name in step 12.
    

    {
        "Version": "2012-10-17",
        "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                        "kms:Encrypt",
                                        "kms:Decrypt",
                                        "kms:ReEncrypt*",
                                        "kms:GenerateDataKey*",
                                        "kms:DescribeKey"
                            ],
                            "Resource": [
                                            "<KMS_KEY_ARN>"
                            ]
                        },
                        {
                            "Effect": "Allow",
                            "Action": "s3:*",
                            "Resource": [
                                            "arn:aws:s3:::<BUCKET_NAME>",
                                            "arn:aws:s3:::<BUCKET_NAME>/*"
                            ]
                        }
        ]
    }

26. Click Review policy at the bottom.

27. Give a Name for the policy (for example, access-to-s3-<BUCKET_NAME>) and click Create policy at the bottom.

28. Send the following details to Conviva customer support team through Pulse Portal Support page or email them to Conviva Support: