> ## Documentation Index
> Fetch the complete documentation index at: https://docs.up.telestream.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings UP AWS S3 Roles

### Configuring AWS

To configure AWS:

1. Log into your AWS Console. Browse to the *Identity and Access Management* (IAM) page. Create an access Policy, and then create a Role, connecting the Policy to the Role.
2. Browse to *Access Management* > *Policies*.
3. Click the *Create policy* button.<br />IAM opens the *Specify permissions* page.
4. In the Resource section, using the Allow directive, grant access to the s3:GetObject, s3:ListBucket, and s3:PutObject.
5. Add the named buckets to which you want to grant this access.<br />Here’s an example of this policy:

```text theme={null}
{
"Version": "2012-10-17",
"Statement": [
	{
	"Effect": "Allow",
	"Principal": {
	"AWS": "arn:aws:iam::851725353997:root"
	},
	"Action": "sts:AssumeRole",
	"Condition": {
	"StringEquals": {
	"sts:ExternalId": "2f9a3654-6665-4ace-b025-4ca8a5ac8c60"
	}
	}
	}
]
}
```

<Note>
  Resource must contain two entries: one with a trailing slash and a wildcard (for GetObject and PutObject) and the one without a trailing slash for ListBucket. If a trailing slash is added, the role doesn’t work.
</Note>

6. Click *Next*.<br />IAM opens the *Review and create* page.
7. Browse to *Access management* > *Roles*.
8. Click the *Create role* button.
9. Select *Custom trust policy* and enter the custom trust policy.<br />This is an example:

```text theme={null}
{
"Version": "2012-10-17",
"Statement": [
	{
	"Effect": "Allow",
	"Principal": {
	"AWS": "arn:aws:iam::851725353997:root"
	},
	"Action": "sts:AssumeRole",
	"Condition": {
	"StringEquals": {
	"sts:ExternalId": "2f9a3654-6665-4ace-b025-4ca8a5ac8c60"
	}
	}
	}
]
}
```

<Note>
  The AWS key within the Principal object contains the Telestream AWS account ID that is allowed to *assume the role* and access the data. This is exposed to the user within the Storage interface of the platform. The sts:ExternalId is the unique identifier for the customer’s organization. This is also shown within the Storage settings. This forms a unique trust relationship: access is granted only if the Telestream product sends the same external identifier.
</Note>

IAM prompts you to select the policy you just created.

10. Find the policy by searching for its name.
11. Select the policy and click *Next*.
12. Name the role and give it a description.
13. View the new role and copy its ARN unique identifier.