--- schema_version: "1" id: a58bf645d4da1ec38b94db19715d5c50be61e7356eb5cc52dc1491e7daf0cdc3 title: Amazon S3 Private Connection collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/bi_integrate_connectors_s3vpc.md canonical_url: https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_s3vpc.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: fd62853aaefb74fd917950a095316bbd7be94ec98de8fd6334859dec0048e54e description: Pull your data securely from S3 running on AWS into Data Manager using the Virtual Private Connection (VPC) for S3 input connector for CRM Analytics. To use the S3 Private connector, you configure an outbound network connection, external credential, and named credential. products: - CRM Analytics - Cross Cloud release: "264" --- # Amazon S3 Private Connection Pull your data securely from S3 running on AWS into Data Manager using the Virtual Private Connection (VPC) for S3 input connector for CRM Analytics. To use the S3 Private connector, you configure an outbound network connection, external credential, and named credential. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png) Note You can’t use a custom authorization provider. ## Prerequisites - Requires [Salesforce Private Connect](https://help.salesforce.com/s/articleView?id=sf.private_connect_overview.htm&type=5&language=en_US). - You must configure your private link for Amazon S3, to learn how to do this see the AWS guide [AWS PrivateLink for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html). For help with configuring this connection so that it’s consistent with your organization’s security requirements, contact your network security or IT department. ## Allowlist the Salesforce AWS Account for S3 Private Connect To verify your AWS account is on the allowlist for Salesforce private connect, see [Verify Salesforce AWS Account for Private Connect](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_private_allowlist.htm&release=264.0.0&type=5 "For your Snowflake, Redshift, or S3 private connector to work, verify your AWS account is listed as a Private Connect."). ## Create an Outbound Network Connection To create an outbound network connection, see [Create the Outbound Network Connection](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_private_outbound_connection.htm&release=264.0.0&type=5 "Create a primary outbound network connection to support your Virtual Private Connection (VPC)."). ## Create an External Credential and Principal Access 1. From Setup, in the Quick Find box, enter Named, and then select **Named Credentials**. 2. On the External Credentials tab, click **New**. 3. Enter a label and name. 4. For Authentication Protocol, select **No Authentication**. ![New external credentials screen showing entered connection name and label, and the no authentication option selected.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_s3vpc_external_credentials.png) 5. Save your external credential. Add a principal to the external credential. 1. Open the new external credential 2. In the Principals section, click **New**. 3. Enter S3VPCPrincipalAccess for the parameter name and 1 for the sequence. ![New principal screen showing entered parameter name, sequence, and the named principal option selected.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_s3vpc_principal.png) Now update your user profile with external credential principal access. 1. From Setup, in the Quick Find box, enter Profiles, and then select **Profiles**. 2. Select the profile for the **Analytics Cloud Integration User**. 3. Click **Enabled External Credential Principal Access** at the top of the profile page. 4. Click **Edit** and add **S3PrivateEC - S3PrivatePrincipal**. 5. Click **Save**. Ensure your user has principal access. 1. From Setup, in the Quick Find box, enter Named, and then select **Named Credentials**. 2. On the External Credentials tab, select your credential, and click **Edit** for S3VPCPrincipalAccess. Verify you see your user in the Principal Access section. ![Edit principal screen showing user access.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_s3vpc_principal2.png) ## Create a Named Credential 1. From AWS, find the endpoint URL for your S3 bucket. 2. From Setup, in the Quick Find box, enter Named, and then select **Named Credential**. 3. On the Named Credentials tab, click **New**. 4. Enter a label and name. 5. For URL, enter https://..amazonaws.com. 6. Select the external credential and outbound network connection that you created. ![New Named Credentials screen showing entered connection name and label, URL, and external credentials and outbound network connection values selected.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_s3vpc_named_credentials.png) 7. Save your named credential. ## Create a S3 VPC Connection 1. On the Data Manager Connections tab, click **New Connection**. 2. Select **Private**, then the Amazon S3 Private Connector, and click **Next**. ![The Select Connecter screen showing the Amazon S3 Private Connector.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_s3vpc_select_connector.png) 3. Enter the connector settings. ![The Set Up Your Connection screen showing the required details entered.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_s3vpc_connection_setup.png) 4. To validate your settings and test the connection, click **Save & Test**. If the connection fails, CRM Analytics shows possible reasons. All settings require a value, unless otherwise indicated. | Setting | Description | | --- | --- | | Connection Name | Required. Use a name that lets you easily distinguish between different connections. | | Developer Name | Required. The API name is used in your recipes to reference data extracted through this connection. This name can’t include spaces. You can’t change the API name after you create the connection. | | Description | Required. The description for the connection. | | Authentication Type | Required. The authentication type. Valid values include `Root` For standard authentication, and `IAM`, for AWS Identity Access Management (IAM) authentication. Use IAM authentication for granular access to AWS data, setting up IAM users and roles in AWS. For more information on AWS IAM, see [Getting Started with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started.html) on AWS | | Named Credential | Required. The Name field from the named credential stored in your Salesforce org. | | Access Key | Required. Your Amazon S3 bucket access key ID. | | Secret Key | Required. Your Amazon secret access key. | | Master Symmetric Key | Required. Use this to manage client-side encryption. You can connect to objects encrypted with customer master keys stored in the AWS Key Management Service or a customer-generated key in the 256-bit AES format. See Amazon’s documentation for details. | | Region Name | Required. The region of your S3 service, for example EU (Ireland). For the list of region names, see the S3 Region Names below. | Amazon Region Names | Region Name | Amazon Code | | --- | --- | | US East (Ohio) | us-east-2 | | US East (N. Virginia) | us-east-1 | | US West (N. California) | us-west-1 | | US West (Oregon) | us-west-2 | | Africa (Cape Town) | af-south-1 | | Asia Pacific (Hong Kong) | ap-east-1 | | Asia Pacific (Mumbai) | ap-south-1 | | Asia Pacific (Osaka) | ap-northeast-3 | | Asia Pacific (Seoul) | ap-northeast-2 | | Asia Pacific (Singapore) | ap-southeast-1 | | Asia Pacific (Sydney) | ap-southeast-2 | | Asia Pacific (Tokyo) | ap-northeast-1 | | Canada (Central) | ca-central-1 | | China (Beijing) | cn-north-1 | | China (Ningxia) | cn-northwest-1 | | EU (Frankfurt) | eu-central-1 | | EU (Ireland) | eu-west-1 | | EU (London) | eu-west-2 | | Europe (Milan) | eu-south-1 | | EU (Paris) | eu-west-3 | | EU (Stockholm) | eu-north-1 | | Middle East (Bahrain) | me-south-1 | | South America (Sao Paulo) | sa-east-1 | | AWS GovCloud (US-East) | us-gov-east-1 | | AWS GovCloud (US-West) | us-gov-west-1 | For more information on S3 connector considerations and the S3 bucket hierarchy, see [Amazon S3](https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_s3.htm&release=264.0.0&type=5 "Create a remote connection using the Amazon S3 connector to sync CSV data from an S3 bucket to CRM Analytics.")