---
schema_version: "1"
id: 39015a1959bdb81886adb3611865988d3f44cf85fe093038256e671b9f0f1257
title: Create S3 Bucket for Salesforce Voice SAML Metadata
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/voice_saml_metadata.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.voice_saml_metadata.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 96448e8fc5f2fb9a4e7d0e7393e6756b6c2524a0d4fe15cf4462f9d02e150bff
description: Create an AWS S3 bucket with S3 bucket policy for SAML metadata in the same region where you execute the BYOATenantStack.
products:
  - Service Cloud
  - Digital Engagement
release: "264"
---
# Create S3 Bucket for Salesforce Voice SAML Metadata

Create an AWS S3 bucket with S3 bucket policy for SAML metadata in the same region where you execute the BYOATenantStack.

### Required Editions

This article applies to:

- Salesforce Voice with Partner Telephony from Amazon Connect (Voice manually integrated with your Amazon Connect instance by importing the contact center definition XML file)

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=service.voice_editions.htm&amp;release=264.0.0&amp;type=5" title="Learn about the user interfaces, editions, and add-ons that support Voice solutions by Salesforce.">View supported editions</a>.</td></tr></tbody></table>

1. Create an AWS S3 bucket for SAML metadata. Though you can use any name for the AWS S3 bucket, it’s recommended to use the `<CustomerPrefereds3bucketPrefix>-scv-saml-metadata` pattern for the name.
    
    You must create the S3 bucket in the same region where you execute the BYOATenantStack.
2. Add the bucket policy.
    
    `{ "Version": "2008-10-17", "Statement": [ { "Sid": "AllowS3PutAccessForIntegrationUser", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::<AWS_ACCOUNT_ID>:user/<USER_NAME>" }, "Action": "s3:Put*", "Resource": "arn:aws:s3:::<CustomerPrefereds3bucketPrefix>-scv-saml-metadata/*" }, { "Sid": "AllowS3AccessForResourcessToSubAccount", "Effect": "Allow", "Principal": "*", "Action": "s3:Get*", "Resource": "arn:aws:s3:::<CustomerPrefereds3bucketPrefix>-scv-saml-metadata/*", "Condition": { "StringEquals": { "aws:PrincipalServiceName": "cloudformation.amazonaws.com" } } }, { "Sid": "AllowS3AccessForIamRole", "Effect": "Allow", "Principal": "*", "Action": "s3:Get*", "Resource": "arn:aws:s3:::<CustomerPrefereds3bucketPrefix>-scv-saml-metadata/*", "Condition": { "ArnEquals": { "aws:PrincipalArn": [ "arn:aws:iam::*:role/IDPLambdaRole", "arn:aws:iam::*:role/SCVIDPLambdaRole" ] } } }, { "Sid": "DenyUnsecuredS3Access", "Effect": "Deny", "Principal": "*", "Action": "*", "Resource": "arn:aws:s3:::<CustomerPrefereds3bucketPrefix>-scv-saml-metadata/*", "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] }`

The S3 bucket for SAML metadata stores the SAML metadata document. The ProviderCreator resource of `BYOATenantStack` fetches the SAML Metadata document to configure the SAML authentication between the Salesforce org and the Amazon Connect instance.

The `BYOATenantStack` fetches the SAML metadata document with the same name as provided in the parameter for the S3 bucket for SAML metadata.