Settings UP AWS S3 Roles - Telestream UP Documentation

Configuring AWS

To configure AWS:

Log into your AWS Console. Browse to the Identity and Access Management (IAM) page. Create an access Policy, and then create a Role, connecting the Policy to the Role.
Browse to Access Management > Policies.
Click the Create policy button.
IAM opens the Specify permissions page.
In the Resource section, using the Allow directive, grant the S3 actions that match the access level you want the platform to have on the bucket. Choose the least-privilege policy for your use case from the three options below.
Add the named buckets to which you want to grant this access.

Pick one of the following policies based on which platform operations you need to enable. Replace mybucket with your bucket name.

Read (R)
Read/Write (RW)
Read/Write/Delete (RWD)

Enables the platform to list and read objects from the bucket. Use this for source-only storages where the platform ingests or reads media but never writes back.Actions: s3:GetObject, s3:ListBucket

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mybucket/*",
                "arn:aws:s3:::mybucket"
            ]
        }
    ]
}

Enables the platform to list, read, and write objects. Use this for destination storages where the platform delivers or writes new objects but must not remove existing ones.Actions: s3:GetObject, s3:ListBucket, s3:PutObject

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:ListBucket",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mybucket/*",
                "arn:aws:s3:::mybucket"
            ]
        }
    ]
}

Enables the platform to list, read, write, and delete objects. Use this for working storages where the platform manages the full object lifecycle, including cleanup and overwrites.Actions: s3:GetObject, s3:ListBucket, s3:PutObject, s3:DeleteObject

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:ListBucket",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mybucket/*",
                "arn:aws:s3:::mybucket"
            ]
        }
    ]
}

Resource must contain two entries: one with a trailing slash and a wildcard (for GetObject and PutObject) and the one without a trailing slash for ListBucket. If a trailing slash is added, the role doesn’t work.

Click Next.
IAM opens the Review and create page.
Browse to Access management > Roles.
Click the Create role button.
Select Custom trust policy and enter the custom trust policy.
This is an example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111111111111:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "2f9a3654-6665-4ace-b025-4ca8a5ac8c60"
                }
            }
        }
    ]
}

The AWS key within the Principal object contains the Telestream AWS account ID that is allowed to assume the role and access the data. This is exposed to the user within the Storage interface of the platform. The sts:ExternalId is the unique identifier for the customer’s organization. This is also shown within the Storage settings. This forms a unique trust relationship: access is granted only if the Telestream product sends the same external identifier.

IAM prompts you to select the policy you just created.

Find the policy by searching for its name.
Select the policy and click Next.
Name the role and give it a description.
View the new role and copy its ARN unique identifier.

​Configuring AWS

Configuring AWS