---
sourceDocument: Australia Workflow Data Fabric
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/integrate-applications

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Workflow Data Fabric

ft:clusterId :

    - crint

bundleId :

    - crint

workflow :

    - Creator


---

# Prepare to run the Amazon S3 collector

# Prepare to run the Amazon S3 collector {#ariaid-title1}

Release version: Australia  
Updated June 18, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create an AWS IAM user with the permissions required for the metadata collector to harvest metadata from Amazon S3 buckets and objects.

## Before you begin

Role required: admin

## About this task

The collector authenticates to Amazon S3 using either an AWS credentials file or an access key ID and secret access key. Complete the following steps to create a dedicated IAM user, assign the required permissions, obtain an
access key, and set up a credentials file.

## Procedure

1. Create an IAM user for running the collector.  
   1. Log in to the [AWS portal](https://console.aws.amazon.com/) and navigate to the IAM service.
   2. Under Users, select Add users.
   3. Enter a name for the user and complete the user creation workflow.
2. Assign the following permissions to the user.  
   {#prepare-to-run-amazon-s3-collector__table-s3-permissions__entry__3}

   | Permission | AWS API | Object cataloged using the permission |
   |-|-|-|
   | `s3:ListAllMyBuckets` | [`ListBuckets`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html) | List of all buckets owned by the user |
   | `s3:GetBucketLocation` | [`GetBucketLocation`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html) | The region the bucket resides in |
   | `s3:ListBucket` | [`ListObjectsV2Paginator`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) | The list of objects within included buckets |
   | `s3:GetBucketVersioning` | [`GetBucketVersioning`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html) | The versioning state of the bucket |
   | `s3:GetBucketAcl` | [`GetBucketAcl`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html) | The ACL (access control list) of the bucket |
   | `s3:GetObjectAcl` | [`GetObjectAcl`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html) | The ACL (access control list) of the object |
   | `s3:GetObject` | [`HeadObject`](https://docs.aws.amazon.com/AmazonS3/latest/API/API_HeadObject.html) | The metadata of an object |
   [Table 1. Required IAM permissions for the Amazon S3 collector]

   {#prepare-to-run-amazon-s3-collector__table-s3-permissions}
3. Obtain an access key for the user.  
   If you already have an access key for the user, skip this step. Detailed AWS documentation on this topic is [available in the AWS Tools for PowerShell documentation](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-appendix-sign-up.html).
   1. In the IAM service, under Users, select the user.
   2. On the Security credentials tab, select Create access key.
   3. Select Application running outside AWS, then select Next.
   4. Enter an optional description tag, then select Create access key.
   5. Copy the Access key ID and Secret access key values. You need these values when configuring the collector.
   {#prepare-to-run-amazon-s3-collector__ol_wyt_k4d_qjc}
4. Set up an AWS credentials file.  
   If you already have the AWS CLI installed and a credentials profile file configured, skip this step.
   1. Install the AWS CLI. For details, see the [AWS CLI installation documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).
   2. From the command line, run [`aws configure`](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).

      This command stores the credentials in \~/.aws/credentials.

## Result

The IAM user has the permissions required to run the Amazon S3 metadata collector.

## What to do next

Use these credentials when configuring the collector. See [Create an Amazon S3 metadata collector](https://www.servicenow.com/docs/kK0cmMs3JBxCBMXjLfMLaw "Use a metadata collector to import Amazon S3 bucket and object metadata into the data catalog.").