> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sequentum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# S3

> Configure Amazon S3 as an export destination and troubleshoot its IAM permissions.

Sequentum Cloud can export data directly to Amazon S3. It uses AWS AssumeRole to obtain temporary, limited credentials, so you control access through the permissions on your external IAM role. The **S3** command is located under **Export** in the command palette.

## Configure an S3 destination

From the Sequentum Cloud dashboard, select **Organization** in the lower-left corner, then open the **Destinations** tab.

![Organization Destinations tab in Sequentum Cloud](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-01.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=e04a18900e42d12b4db6aee6a18de59e)

Select **New Destination** to add an S3 export.

![New S3 destination form](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-02.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=0d38514926c9557856f4727cd1e3f85e)

Enter a destination name and description, and leave the destination type set to **S3 Bucket**. Enter the bucket name and the folder where you want to deliver the data. Sequentum Cloud generates a policy based on these settings.

![S3 bucket and folder settings with a generated policy](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-03.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=e9efc24c0b328bacad03c43167693465)

Scroll down and enter the role ARN.

![Role ARN field for an S3 destination](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-04.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=0997dbb1e5f589e2d39644acb478b233)

> [!NOTE]
>
> Enter the complete role ARN, for example `arn:aws:iam::666666666666:role/examplerole`.

After completing the destination settings, apply the generated policies in AWS if they are not already configured.

First, copy everything under **Policy** to an inline permission on your external IAM role. Open the specified role, add an inline permission, paste the policy, select **Next**, name the permission, and save it. This permission lets the role upload files to the specified bucket. Add more entries under `Action` if the role requires additional permissions.

![AWS IAM inline permission that allows uploads to the S3 bucket](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-05.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=d7bcc09b42ec167988003afd2d2fe87e)

After creating the permission, open the **Trust relationships** tab, select **Edit trust policy**, paste the generated trust policy, and update the policy. This allows the Sequentum upload role to assume your external IAM role and perform the upload.

![AWS IAM trust policy that allows the Sequentum upload role to assume the external role](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-06.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=8be9c03dd27ee678843fb5dde184c7b5)

Return to the Sequentum Cloud destination and select **Test Connection**. If the configuration is correct, Sequentum Cloud uploads a test file to your S3 bucket.

![Test file uploaded to the configured S3 bucket](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-07.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=5643aca1a3749ee6da531a2a6020bdf5)

## Add the destination to an Agent

Create an S3 export in your Agent, select the destination you created under **Destination name**, and save your changes. When the Agent finishes running and generates its CSV file, it also delivers the file to your S3 bucket.

![S3 destination selected in an Agent export command](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-08.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=22d2b7f2f2df1d54c6ad4aff273ccd07)

## Common troubleshooting errors

If you encounter issues during setup, use the following checks to diagnose the configuration.

### Add a bucket policy to allow access

Ensure that the bucket policy allows your IAM role to put objects in the bucket. For example:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::666666666666:role/your-iam-role"
      },
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::examplebucket/*"
    }
  ]
}
```

This policy allows `arn:aws:iam::666666666666:role/your-iam-role` to upload objects to `arn:aws:s3:::examplebucket` and set their access controls.

### Verify IAM role permissions

Ensure that the IAM role has permission to interact with the specified S3 bucket. Its inline policy should resemble the following example:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::examplebucket/*"
    }
  ]
}
```

### Verify the trust relationship policy

Ensure that the trust policy allows the Sequentum role `arn:aws:iam::280772890673:role/sequentum-upload-qa` or `arn:aws:iam::280772890673:role/sequentum-upload-prod`, depending on your environment, to assume the external IAM role and upload files.

For example:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::280772890673:role/sequentum-upload-qa"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "seq_p8OgYZNm_anQEaOZ8-mMn"
        }
      }
    }
  ]
}
```

The required Sequentum role may differ by environment. If necessary, allow both the QA and production roles.

### Confirm the external ID

If you copied the trust policy directly from the Sequentum Cloud destination page, the external ID should match. Compare the external ID in Sequentum Cloud with the value in the AWS trust policy.

![Matching external ID values in the AWS trust policy and Sequentum Cloud](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-09.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=d77ca3abde292e27938becb9f27589f8)

### Confirm the role ARN

Confirm that the role ARN includes the full `arn:aws:iam::` prefix.

![Complete AWS IAM role ARN in the S3 destination settings](https://mintcdn.com/sequentum/dOYM46qwxTPgqNVx/images/agents/commands/s3/img-10.png?fit=max\&auto=format\&n=dOYM46qwxTPgqNVx\&q=85\&s=767c6f910280d003ddb52e2ac4b90f09)

If you still cannot export to your S3 bucket after completing these checks, contact [support@sequentum.com](mailto:support@sequentum.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.