---
sourceDocument: Australia ServiceNow AI Platform Administration
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-administration

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia ServiceNow AI Platform Administration

ft:clusterId :

    - platadm

bundleId :

    - platadm

workflow :

    - Platform


---

# AWS permissions required for Amazon S3 external content connector permission modes

# AWS permissions required for Amazon S3 external content connector permission modes {#ariaid-title1}

Release version: Australia  
Updated October 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The Identity and Access Management (IAM) user for an Amazon S3 external content connector requires Amazon S3 and IAM permissions that depend on the permission mode.

## Permissions by mode {#amazon-s3-required-permissions-external-content-connector__amazon-s3-required-permissions-by-mode}

Grant the permissions in the following table to the Identity and Access Management (IAM) user whose access key the connector uses. To learn how to create this user and its policy, see [Configure Amazon S3 for external content indexing](https://www.servicenow.com/docs/ED9R4K9Qwap~jqXAUvGgAQ "Create an Identity and Access Management (IAM) user and access key that the Amazon S3 external content connector uses to access your Amazon S3 source system."). To learn about the modes, see [Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/yTu2iF76Se4Nx0CVh5y6WQ "The Amazon S3 external content connector offers multiple permission modes to control which users can see its crawled content items in AI Search applications.").
{#amazon-s3-required-permissions-external-content-connector__table_required_permissions__entry__2}

| Permission mode | Required permissions |
|-|-|
| All modes | * `s3:GetBucketLocation` * `s3:GetObject` * `s3:ListBucket` {#amazon-s3-required-permissions-external-content-connector__ul_sw3_15g_blc} |
| Standard user permission crawl | The permissions for all modes, plus the following permissions: * `iam:GetGroup` * `iam:GetGroupPolicy` * `iam:GetPolicy` * `iam:GetPolicyVersion` * `iam:ListAttachedGroupPolicies` * `iam:ListGroupPolicies` * `iam:ListGroups` * `iam:ListRoles` * `iam:ListUsers` * `s3:GetBucketPolicy` {#amazon-s3-required-permissions-external-content-connector__ul_n3t_wtg_blc} |
| User permission crawl with a connector-created group of all retrieved users | The permissions for all modes, plus `iam:ListUsers`. |
| No user permission crawl with an existing group | The permissions for all modes. This mode requires no IAM permissions. |
[Table 1. Permissions required by each permission mode]

{#amazon-s3-required-permissions-external-content-connector__table_required_permissions}  
Important:  
In the standard user permission crawl, if the connector can't list IAM users and roles, it can't resolve the principals in a bucket policy. In that case, the connector indexes no content from the affected buckets. If the connector can't read the policy for a bucket, for example because `s3:GetBucketPolicy` is denied, no user can see content items indexed from that bucket.
**Related concepts**   

* [Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/yTu2iF76Se4Nx0CVh5y6WQ "The Amazon S3 external content connector offers multiple permission modes to control which users can see its crawled content items in AI Search applications.")  
**Related tasks**   

* [Configure Amazon S3 for external content indexing](https://www.servicenow.com/docs/ED9R4K9Qwap~jqXAUvGgAQ "Create an Identity and Access Management (IAM) user and access key that the Amazon S3 external content connector uses to access your Amazon S3 source system.")