Send to Amazon S3 Bucket

One of the output options for a configured channel is to send to the Amazon S3 bucket. This delivery method creates an output file and uploads it to Amazon S3.

Use the Amazon S3 receiver when file deliveries should be uploaded directly to an Amazon S3 bucket rather than downloaded manually or transferred through SFTP / HTTP. This delivery method is commonly used for automated integrations, large file transfers, and cloud-based workflows.

Creating the Configuration

To complete the configuration, follow the 'Next' prompts in the 'Output configuration' popup after selecting the desired output type and completing the required fields.

If the 'Category output template' is enabled, the standard template will be overridden.

Note: A template must be available and selected in the Default output template section in order to publish the receiver.

Connection Settings

The table below contains specific information for Amazon S3 bucket connection settings.

The Bucket ID provided should not be an Amazon Resource Name (ARN). The Amazon Web Services Software Development Kit (AWS SDK) does not accept a bucket ARN where a bucket name is expected. Using an ARN will cause the upload request to fail before it reaches AWS. Enter only the part after the final colon. The below screenshot provides examples.

Output Configuration Settings

1. Link expiration: sets the length of live availability for the link to the download file.

2. Asset settings

   1. Asset delivery: allows you to select the method of asset delivery for the download from a dropdown.

      

   2. Rename asset(s): allows renaming of assets following a set rule as described below.

      

      A default setting is also available to rename assets as shown in the screenshot below.

      

   3. Assets grouping: provides a dropdown to allow you to select how assets are grouped.

      

3. Single output file

   1. Do not zip output containing single file – user has ability to turn zip function off.

   2. Allows user to rename single file output according to a set rule as shown below.

      

      A default setting is also available to rename the output file as shown in the screenshot below.

      

4. Product settings: either (but not both) of the options in the screenshot below can be activated by the user.

   

5. Products batch size: user can choose how many products will be sent in a single submission.

   

Completed Form

The screenshot below is an example of a completed receiver form. Once a form has been completed, click 'Apply' to apply the selected values.

Prerequisites: Granting Stibo Systems Access to Bucket

Before the receiver can deliver files, the AWS Identity and Access Management (IAM) user or role associated with the configured credentials must be able to perform s3:PutObject on the target prefix, and the bucket policy must not deny the request.

If the bucket policy restricts access by network

Many organizations restrict bucket access with a Deny statement conditioned on source IP. In this instance, an IP allow-list on its own is not sufficient for PDX.

PDX reaches Amazon S3 by two different network paths — which one is used depends on where the bucket is located:

• The bucket is in the same AWS region as the PDX environment: Traffic goes through an S3 gateway Virtual Private Cloud (VPC) endpoint and never leaves the AWS network. The source IP that arrives at the bucket is a private address, not a public Stibo Systems IP so an aws:SourceIp condition can never match it.

• The bucket is in a different region: Traffic leaves through Stibo's Network Address Translation (NAT) gateway and arrives from one of our public IP addresses.

Because either path may be used, the policy must allow both — our public IP addresses and our S3 gateway VPC endpoint IDs.

Public IP addresses

All listed IP addresses should be allowed — any may be used during failover or a service outage.

1
2
3
4
5
6
50.16.149.59
34.206.196.233
44.193.104.249
3.135.21.33
3.143.162.117
3.143.198.87

S3 gateway VPC endpoint IDs

If the restriction is expressed as a Deny with a NotIpAddress condition, add the endpoint IDs alongside it so that both paths are permitted as shown in the example below:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
"Condition": {
  "NotIpAddress": {
    "aws:SourceIp": [
      "50.16.149.59/32",
      "34.206.196.233/32",
      "44.193.104.249/32",
      "3.135.21.33/32",
      "3.143.162.117/32",
      "3.143.198.87/32"
    ]
  },
  "StringNotEquals": {
    "aws:SourceVpce": [
      "vpce-0469ca6d8211c4953",
      "vpce-09822acde3eaa88b3",
      "vpce-0c9abccdd7e6960e5"
    ]
  }
}

Other bucket policy conditions to check

If uploads are still denied, good practice is to check if the existing bucket policy denies s3:PutObject under any of the following conditions:

• Encryption required: a Deny when s3:x-amz-server-side-encryption is absent, or when s3:x-amz-server-side-encryption-aws-kms-key-id is not one specific key. If a Key Management Service (KMS) key is required, the IAM user also needs kms:GenerateDataKey and kms:Encrypt on that key.

• Access Control List (ACL) required: a Deny unless s3:x-amz-acl is bucket-owner-full-control.

• Prefix-scoped deny: confirm the folder path configured in PDX falls inside the permitted prefixes.

Troubleshooting

Messages in the left column are generated in the submission log.

Note: If your AWS administrator needs to trace a specific denied request, Stibo Systems Support can provide the AWS request ID and extended request ID from our logs. These identify the exact call in your CloudTrail events.

Note: You can be notified automatically when submissions fail, rather than discovering it later. See Notifications Settings under Profile and Account Settings.

Frequently Asked Questions