---
schema_version: "1"
id: 4c5e94472ffccfc854b26bf084093a3351166bbd0ad2e5171d008a5c69fbf8c4
title: Use Identity Provider–Based Authentication for S3 Connectors
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/guides/awss3/c360-a-awss3-connector-idp-settings.md
canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-awss3-connector-idp-settings.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 04f63948f4ec32bf445c8f810ad00f7db24d4b2a010bf77522aa09f6b1a469b5
products:
  - Data 360 Integration Guide
  - Data 360 Developer Documentation
---
# Use Identity Provider–Based Authentication for S3 Connectors

Add an identity provider (IdP) and create the necessary policies in AWS to use IdP-based authentication when connecting to an S3 bucket using S3 connectors.

Before you begin, refer to [Set Up Amazon S3 Connection](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-awss3-connection.md) and create an S3 connection. Copy the generated External ID.

**important:** IdP-based authentication is only supported for structured data.

1.  Add an identity provider for Salesforce in AWS.

    1.  In the navigation pane of IAM, choose **Identity providers**, and then choose **Add provider**.

    2.  For **Configure provider**, choose **OpenID Connect**.

    3.  Enter the My Domain URL details for the provider URL and audience.

        | IdP Details in AWS Management Console | URL Format                          | Example                                                                                      |
        | ------------------------------------- | ----------------------------------- | -------------------------------------------------------------------------------------------- |
        | Provider URL                          | _My Domain URL_/services/connectors | `https://dlt0000007luz2am-dev-ed.develop.test1.my.pc-rnd.salesforce.com/services/connectors` |
        | Audience                              | _My Domain URL_                     | `https://dlt0000007luz2am-dev-ed.develop.test1.my.pc-rnd.salesforce.com`                     |

        **tip:** To find the My Domain URL of your org, go to Setup, click Settings, and then Company Settings. Click My Domain to find your Current My Domain URL. For more information, see [My Domain](https://help.salesforce.com/s/articleView?id=domain_name_overview.htm).
        In addition, to avoid errors, don't add special characters (such as '/') to the end of URLs.

    4.  Verify the information you provided and choose **Add provider**.

        IAM attempts to retrieve and use the top intermediate CA thumbprint of the OIDC IdP server certificate to create the IAM OIDC identity provider.

2.  Create the necessary roles in AWS for the Data Cloud S3 connector to connect with an S3 bucket. See [Creating a role using custom trust policies (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html).

3.  Associate a permission policy to the role. See [Amazon S3 Bucket Policies and Permissions](https://help.salesforce.com/s/articleView?id=c360_a_s3_bucket_policies.htm&language=en_US&type=5) to know the permission policies that can be applied to the role.

4.  Associate a trust policy to the role using the External ID obtained during the [S3 connection setup](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-awss3-connection.md).

    Sample trust policy

    ```nolang
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Federated": "arn:aws:iam::240852588578:oidc-provider/dlt0000007luz2am-dev-ed.develop.test1.my.pc-rnd.salesforce.com/services/connectors"
                },
                "Action": "sts:AssumeRoleWithWebIdentity",
                "Condition": {
                    "StringEquals": {
                        "dlt0000007luz2am-dev-ed.develop.test1.my.pc-rnd.salesforce.com/services/connectors:sub": "app:DE809C7E:1E96683A"
                    }
                }
            }
        ]
    }

    ```

5.  Get the Amazon Resource Name (ARN) of the role and use it as the IAM Role Name to [Set Up Amazon S3 Connection](https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-awss3-connection.md).