AWS Credentials for Smart Ingest

Smart Ingest lets you pull data from Amazon S3 and Amazon Athena and import it to Iterable. To get started, you need to generate AWS credentials and configure them in Iterable.

# In this article

# Ways to connect

Whether you're connecting to Amazon S3 or Amazon Athena, you need to provide AWS credentials for Smart Ingest to access your data.

There are two ways to connect to AWS:

• Access Key: Connecting to AWS with an access key allows you to configure Smart Ingest to use an IAM user by providing the user's Access Key ID and Secret Access Key.

• Cross-Account Role: Cross-account roles allow you to grant secure access to Smart Ingest without handing over sensitive secrets. This method uses Hightouch's AWS account to establish a trust relationship between your AWS account and Smart Ingest.

In both cases, you need to provide the necessary permissions for Smart Ingest to access your data. For more information, read Minimum permissions.

# Minimum permissions for AWS

The required permissions depend on the service you're using and which Smart Ingest features you intend to use.

• For Amazon S3, read Minimum permissions for Amazon S3.

• For Amazon Athena, read Minimum permissions for Amazon Athena.

# Connecting with an access key

To connect with an access key, an AWS administrator can generate an access key for an IAM user. Then, an Iterable user with the Manage Integrations project permission can enter the access key credentials into Smart Ingest.

# Step 1: Create an access key

For instructions for generating an access key, see Managing Access Keys for IAM Users.

Provide your Iterable administrator with the Access Key ID and Secret Access Key.

# Step 2: Enter AWS credentials into Smart Ingest

1. Log in to Iterable as a user with the Manage Integrations project permission and open the project you’re working on.

2. Go to Integrations > Smart Ingest.

3. Click Connect a New Source.

4. Select Amazon S3 or Amazon Athena and click Continue.

5. In Step 1, click New Credentials.

6. Under Access Method, select Access Key.

7. Enter the Access Key ID and Secret Access Key.

8. Click Create.

# Connecting with a cross-account role

To create a cross-account role, you need to have an Iterable administrator and an AWS administrator available.

The Smart Ingest source setup wizard displays an AWS Account ID and a randomly generated AWS External ID.

• The AWS Account ID is static. In this case, Smart Ingest uses the AWS account 324528010823, which is owned by our partner and data processor, Hightouch.

• The AWS External ID is a randomly generated value that Smart Ingest uses to validate the trust relationship between your AWS account and the Hightouch AWS account.

An AWS administrator can enter both of these values into an IAM role in your AWS account.

This is a time-sensitive process, so make sure you follow these steps in order.

1. Generate an external ID in Smart Ingest, and keep the browser open (Iterable)
2. Create a cross-account role in AWS with the details from Smart Ingest.
3. In the same Iterable browser window from the first step, enter AWS credentials into Smart Ingest.

# Step 1: Generate an external ID in Smart Ingest

To generate an external ID:

1. Log in to Iterable as a user with the Manage Integrations project permission and open the project you’re working on.

2. Go to Integrations > Smart Ingest.

3. Click Connect a New Source.

4. Select Amazon Athena and click Continue.

5. In Step 1, click New Credentials .

6. Under Access Method, select Cross-Account Role.

7. Scroll down and copy the AWS Account ID and AWS External ID.

8. Provide these values to your AWS administrator.

9. Keep this page open while your AWS administrator creates the cross-account role in AWS.

   If you close this page before saving, the external ID is no longer valid. You can regenerate the external ID by following these steps again. (The AWS Account ID does not change.)

Be sure to store these values somewhere safe for future reference.

# Step 2: Create a cross-account role in AWS

To create a cross-account role in AWS:

1. In the AWS Console, go to IAM > Roles.

2. Click Create Role.

3. Under Trusted Entity Type, choose AWS Account.

4. Select Another AWS Account and click Require External ID.

5. When prompted, provide the IDs below.

6. On the Add Permissions screen, attach permissions to the role.

7. Choose a role name and click Create Role.

For more information, see AWS's tutorial Delegate Access Across AWS Accounts Using IAM Roles.

# Step 3: Enter AWS credentials into Smart Ingest

1. In the Smart Ingest setup wizard, resume where you left off.
2. Enter the Role ARN from AWS into the Role ARN field.
3. Click Create.

# Next steps

Once you've generated the credentials, you can finish connecting Smart Ingest to Amazon S3 or Amazon Athena by following the steps in these articles:

• Amazon S3 + Smart Ingest
• Amazon Athena + Smart Ingest

# Updating AWS credentials

Once you have added AWS credentials to Smart Ingest, those credentials are locked from view and edit access.

To update your AWS credentials in Smart Ingest, add new credentials and select them in the source configuration.

1. Go to Integrations > Smart Ingest.

2. Find the source you want to update and click Edit.

3. In the source configuration, under Step 1, click New Credentials.

4. Enter the new/updated AWS credentials (either Access Key or Cross-Account Role).

5. Click Create.

6. In the source configuration, under Step 1, select the new credentials from the AWS Credentials dropdown.

7. Click Save Changes.