--- sourceDocument: Australia ServiceNow AI Platform Administration sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-administration Release : - australia ft:locale : - en-US ft:publication_title : - Australia ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # Amazon S3 bucket policy elements supported by the external content connector # Amazon S3 bucket policy elements supported by the external content connector {#ariaid-title1} Release version: Australia Updated October 27, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Amazon S3 bucket policy elements supported by the external content connector The Amazon S3 external content connector in ServiceNow evaluates specific elements of S3 bucket policies to control content indexing during permission crawls. It supports only certain actions, principals, condition keys, and operators, ensuring accurate and secure access evaluation without exposing unauthorized content. Show full answer Show less ## Supported Actions and Effects * **Actions:** Only `s3:GetObject` and wildcard variations like `s3:Get`, `s3:`, or `""` are supported. * **Effects:** Both **Allow** and **Deny** are evaluated, with Deny taking precedence over Allow. * The connector ignores unsupported elements if the statement does not apply to the resource or the read action. ## Supported Principals * IAM user and role ARNs that the connector crawls are granted access. * Wildcard principal ("") grants access only to crawled identities within your AWS account, not globally. * Account root ARN grants access only to that account's crawled users; cross-account roots have no effect. * Best practice: use IAM roles to group users and grant access via roles instead of individual users for simpler bucket policies. ## Supported Condition Keys and Operators * Condition keys must be derivable directly from the principal without extra AWS calls: * `aws:PrincipalArn`: normalized ARN of user or role * `aws:username`: IAM username (not present for roles or root) * `aws:PrincipalAccount`: 12-digit AWS account ID * `aws:PrincipalType`: User, AssumedRole, or Account * Supported operators (with optional `IfExists` suffix): * String operators: `StringEquals`, `StringNotEquals`, `StringLike`, `StringNotLike` * ARN operators: `ArnEquals`, `ArnNotEquals`, `ArnLike`, `ArnNotLike` * The connector does not support operators like Bool, Null, IpAddress, Numeric, or policy variables such as `${aws:username}`. ## Unsupported Elements and Their Impact * The connector does not support `NotPrincipal`, `NotAction`, or `NotResource` elements. * Any unsupported condition key, operator, or policy variable in a statement applying to a content item causes that item to be excluded ("filtered out") from indexing. * Filtered-out content items do not undergo partial or best-effort evaluation to prevent unintended exposure of restricted content. * The connector logs informative messages indicating unsupported elements, such as unsupported condition keys or operators. * Trust policies of roles with unsupported elements do not filter content items but may reduce the recognized number of role members during crawling. ## Practical Implications for ServiceNow Customers * Ensure S3 bucket policies use only supported actions, principals, condition keys, and operators to enable proper content indexing and access control. * Use IAM roles to simplify permissions and avoid listing many individual users in bucket policies. * Review any filtered-out messages in crawl logs to identify unsupported policy elements that may prevent content from being indexed. * Understand that unsupported policy elements lead to content not being indexed rather than partial access, enhancing security compliance. In a standard user permission crawl, the Amazon S3 connector evaluates only the policy elements listed here. It doesn't index content items with policy statements that use other elements. ## Supported actions and effects {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-actions-effects} The connector evaluates only the policy statements whose action matches a supported action. * Actions: `s3:GetObject` and wildcards such as `s3:Get*`, `s3:*`, or `"*"`. * Effects: `Allow` and `Deny`. A `Deny` takes precedence over an `Allow`. {#amazon-s3-bucket-policy-support-external-content-connector__ul_actions_effects} The connector checks a statement for unsupported elements only after it confirms that the statement applies to the content item's resource and to the read action. A statement that uses an unsupported condition under an unrelated action, such as `s3:PutObject`, or that applies to a different prefix, doesn't affect the content item. ## Supported principals {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-principals} The connector resolves principals against the Identity and Access Management (IAM) users and roles that it crawls. * User and role Amazon Resource Names (ARNs): The connector grants access to the named user or role. * Wildcard principal (`"*"`): The connector grants access to the identities it crawled in your AWS account, not to everyone in ServiceNow AI Platform. * Account root (`arn:aws:iam:::root`): The connector grants access to the crawled users of that account. Account roots from other accounts don't grant access to anyone, because the connector doesn't retrieve the identities of other accounts. {#amazon-s3-bucket-policy-support-external-content-connector__ul_principals} When many users need access to a content item, create an IAM role for the group of users and grant access to the role instead. This approach lists one role in the bucket policy, instead of many individual IAM users. ## Supported condition keys {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-condition-keys} The connector supports only condition keys whose value follows from the crawled principal, with no extra AWS call. {#amazon-s3-bucket-policy-support-external-content-connector__table_condition_keys__entry__2} | Condition key | Value the connector uses | |-|-| | `aws:PrincipalArn` | The ARN of the user or role. The connector normalizes an assumed-role session ARN to the role ARN. | | `aws:username` | The IAM user name. This key is absent for roles and for the account root. | | `aws:PrincipalAccount` | The 12-digit account ID, parsed from the ARN. | | `aws:PrincipalType` | `User`, `AssumedRole`, or `Account`, derived from the shape of the ARN. | [Table 1. Supported condition keys] {#amazon-s3-bucket-policy-support-external-content-connector__table_condition_keys} The connector doesn't support any other condition key. Examples of unsupported keys include `aws:userid`, `aws:PrincipalTag/*`, `aws:ResourceTag/*`, `aws:PrincipalOrgID`, `aws:PrincipalOrgPaths`, network keys such as `aws:SourceIp` and `aws:SourceVpc`, session keys such as `aws:MultiFactorAuthPresent` and `aws:SecureTransport`, time keys such as `aws:CurrentTime`, call-chain keys such as `aws:CalledVia`, and keys that start with `s3:`. When a condition key doesn't exist for a principal, the result depends on the operator. A positive operator, such as `StringEquals` or `ArnLike`, fails unless you add the `IfExists` suffix, in which case it passes. A negated operator, such as `StringNotEquals` or `ArnNotLike`, passes either way. As an example, `aws:username` doesn't exist for a role, so a statement that requires `aws:username` to equal a value doesn't grant access to roles. ## Supported operators {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-operators} The connector supports the following operators, each also with the `IfExists` suffix: * String operators: `StringEquals`, `StringNotEquals`, `StringLike`, `StringNotLike`. * ARN operators: `ArnEquals`, `ArnNotEquals`, `ArnLike`, `ArnNotLike`. {#amazon-s3-bucket-policy-support-external-content-connector__ul_operators} The ARN operators match patterns segment by segment, as AWS does. A `*` doesn't match across a colon, so `arn:aws:iam::*` doesn't match `arn:aws:iam::123456789012:user/alice`. The connector doesn't support the following operators and qualifiers: `Bool`, `Null`, the `Date` operators, `IpAddress`, `NotIpAddress`, the `Numeric` operators, `StringEqualsIgnoreCase`, `StringNotEqualsIgnoreCase`, and the `ForAnyValue:` and `ForAllValues:` set qualifiers. Condition values that contain a policy variable, such as `${aws:username}`, aren't supported either. ## Unsupported policy elements and messages {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-unsupported} The connector doesn't support the `NotPrincipal`, `NotAction`, and `NotResource` elements. If a policy statement that applies to a content item contains an unsupported element, condition key, operator, or policy variable, the connector doesn't index the content item. It sets the content item to "filtered out" and records one of the following informational messages. The connector doesn't make a best-effort evaluation or a partial evaluation. When the connector can't determine who can see a content item, it indexes nothing, to help avoid exposing a content item to a user who shouldn't see it. {#amazon-s3-bucket-policy-support-external-content-connector__table_unsupported_messages__entry__2} | Message | Meaning | |-|-| | `unsupported condition: ` | The statement uses a condition key or policy element that the connector doesn't support. For example, `unsupported condition: aws:userid`. | | `unsupported operator: ` | The statement uses an operator that the connector doesn't support. For example, `unsupported operator: IpAddress`. | | `unsupported policy variable: ` | A condition value contains a policy variable, such as `${aws:username}`. | [Table 2. Filtered-out messages] {#amazon-s3-bucket-policy-support-external-content-connector__table_unsupported_messages} A role's trust policy that the connector can't evaluate has a different effect. The connector doesn't filter content items. Instead, it treats the role as having fewer members, or none, and continues the crawl. **Related concepts** * [Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/yTu2iF76Se4Nx0CVh5y6WQ "The Amazon S3 external content connector offers multiple permission modes to control which users can see its crawled content items in AI Search applications.") **Related reference** * [AWS permissions required for Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/5PqbMbmNLVMIfNS4vUq54g "The Identity and Access Management (IAM) user for an Amazon S3 external content connector requires Amazon S3 and IAM permissions that depend on the permission mode.")