---
schema_version: "1"
id: c74df134ebb26dc605ac826e768aae73d500a255d13b04408222925b7e9f7b17
title: Connect the External Search Service to Your Salesforce Org
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ind/264-0-0/aps_external_storage_search_connect.md
canonical_url: https://help.salesforce.com/s/articleView?id=ind.aps_external_storage_search_connect.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f7fe1e5ac260a92f6591d74d6a8ca3edad95a6a6cffa097d0d7088a5fa092846
description: Create authenticated callout configuration and identify the active AWS search provider for your Salesforce org.
products:
  - Public Sector
release: "264"
---
# Connect the External Search Service to Your Salesforce Org

Create authenticated callout configuration and identify the active AWS search provider for your Salesforce org.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d106041e38">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d106041e38 ">To create named credentials and custom settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d106041e38 ">Customize Application</td>

          </tr>
        </tbody>
      </table>

Before you begin, record the gateway API invoke URL and operation path.

#### See Also

- [Define Custom Settings](https://help.salesforce.com/s/articleView?id=platform.cs_define.htm&type=5&language=en_US)

## Create a Named Credential

Secure and simplify authenticated API callouts to your Amazon S3 buckets by defining a named credential. To simplify the setup of authenticated callouts, create an external credential to specify an authentication protocol and then specify a named credential as the callout endpoint.

1. Create an external credential and its principal to specify details of how Salesforce authenticates callouts to resources in Amazon Web Services over HTTP by using the AWS Signature v4 protocol.
    
    For higher security, we recommend that you use STS. See [Create or Edit an AWS Signature v4 External Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_awssig4_ext_cred.htm&language=en_US&type=5).
2. Define a named credential to specify the URL of a callout endpoint.
    
    Make sure that the URL is in this format: `https://{api-id}.execute-api.{region}.amazonaws.com/{stage-name}`.
    
    For example, `https://a1b2c3d4e5.execute-api.us-west-2.amazonaws.com/prod`. See [Create a Named Credential](https://help.salesforce.com/s/articleView?id=xcloud.nc_create_edit_named_credential.htm&language=en_US&type=5).
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ind-public_sector_solutions-264-0-0-production-enus/25746429-1b1c-4bf3-b014-cf92f9531212/images/icon_note.png)
    
    Note When you configure the endpoint in the Salesforce Named Credential, don't include :443 in the host. Including the port causes an AWS Signature Version 4 host mismatch and a 403 SignatureDoesNotMatch response.
3. Use the principal to link the external credential to a permission set or user profile so that users can make callouts using the named credential.
    
    See [Enable External Credential Principals](https://help.salesforce.com/s/articleView?id=xcloud.nc_enable_ext_cred_principal.htm&language=en_US&type=5).

## Create the External Search Custom Setting

1. From Setup, in the Quick Find box, enter Custom Settings, and then select **Custom Settings**.
2. Click **New**.
3. Create a custom setting with these values:
    
    - **Label:** External Search Config
    - **Object Name:** ExternalSearchConfig
    - Select the custom setting type required by your implementation.
4. Save the custom setting.
5. Create these fields.
    
    | Field | Data Type | Description |
    | --- | --- | --- |
    | NamedCredentialName | Text | Developer name of the named credential |
    | OperationPath | Text | Gateway API operation path appended to the named credential URL. Example: If the gateway API endpoint is "https://a1b2c3d4e5.execute-api.us-west-2.amazonaws.com/prod/performsearch", then the OperationPath is "performsearch" |
    | SearchProvider | Text | Search provider identifier: bedrock or kendra. Important: Make sure you provide the values as given here. |
    | TimeoutSeconds | Text | Maximum time allowed for the gateway API callout |
    | IsActive | Checkbox | Indicates whether Salesforce uses this configuration. Only one configuration can be active at a time. |
6. Use the field labels, API names, and data types required by the external storage search implementation.
7. Create an ExternalSearchConfig record for your search service, and then select IsActive.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-ind-public_sector_solutions-264-0-0-production-enus/25746429-1b1c-4bf3-b014-cf92f9531212/images/icon_note.png)
    
    Note Keep only one configuration active at a time. If more than one is active, search behavior is unpredictable.
8. Grant users access to the search configuration.
    
    See [Grant Users Access to Custom Settings](https://help.salesforce.com/s/articleView?id=platform.cs_grant_permission.htm&type=5&language=en_US).