How to create cloudworks anaplan s3 connection

[karthikkumar]

How can we create s3 connection form Anaplan cloudworks, i know with IAM access key and secret access key we can make successful connection. but i need to create S3 connection from Anaplan Cloudworks without using IAM access key and secret access key. Is there any possibilities to make successful connection through like API, or IAM roles etc...

[sheen8]

If you do not want to use IAM access keys and secret access keys, you can create an IAM role with the required permissions and assign it to the instance that will be connecting to S3. This allows the instance to access S3 without having to provide explicit access credentials.

You can also use AWS Security Token Service (STS) to generate temporary security credentials that can be used to access S3. These credentials can be obtained using API calls and can be configured to automatically rotate on a scheduled basis for added security.

It is important to note that whichever method you choose, you will need to ensure that the IAM role or temporary security credentials have the necessary permissions to access the S3 resources you require.

[adwardplatin]

Understanding the Challenge

Typically, connecting to S3 from Anaplan CloudWorks requires IAM access key and secret access key for authentication. However, there's a desire to eliminate the use of these keys for security reasons.

Potential Solutions

1. IAM Roles
Preferred Method: Strongly recommended for enhanced security.

Process:

Create an IAM role with necessary permissions to access the S3 bucket.
Attach the role to the EC2 instance hosting the Anaplan CloudWorks environment.
Configure Anaplan CloudWorks to assume this role when accessing S3.

2. Temporary Security Credentials

Considered: If IAM Roles are not feasible, this can be an alternative.

Process:

Use AWS Security Token Service (STS) to generate temporary credentials with limited expiration.
Employ these credentials within Anaplan CloudWorks for S3 access.
Regularly rotate these credentials for security.

3. AWS Signature Version 4

Complex: Requires in-depth understanding of AWS authentication mechanisms.

Process:

Implement AWS Signature Version 4 authentication logic within Anaplan CloudWorks.
Handle request signing, headers, and other security aspects.

Important Considerations

Security: Prioritize security when choosing a method. IAM Roles are generally the most secure option.
Complexity: Evaluate the complexity of each method based on your team's technical expertise.
Performance: Consider potential performance implications of different approaches.

Cost: Some methods might incur additional costs, such as those associated with STS calls.
Additional Tips

Least Privilege Principle: Grant the IAM role or temporary credentials only the necessary permissions to access the S3 bucket.
Regular Reviews: Periodically review and update IAM roles and permissions.
Monitoring: Implement monitoring to track S3 access and identify potential security issues.
Consider AWS KMS: For enhanced key management, explore using AWS Key Management Service (KMS) to protect your encryption keys.
You can get more info click here.