--- sourceDocument: Brazil ServiceNow AI Platform Administration sourceDocumentLink: https://www.servicenow.com/docs/r/platform-administration Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # Amazon S3 bucket policy elements supported by the external content connector # Amazon S3 bucket policy elements supported by the external content connector {#ariaid-title1} Release version: Brazil Updated October 27, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read In a standard user permission crawl, the Amazon S3 connector evaluates only the policy elements listed here. It doesn't index content items with policy statements that use other elements. ## Supported actions and effects {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-actions-effects} The connector evaluates only the policy statements whose action matches a supported action. * Actions: `s3:GetObject` and wildcards such as `s3:Get*`, `s3:*`, or `"*"`. * Effects: `Allow` and `Deny`. A `Deny` takes precedence over an `Allow`. {#amazon-s3-bucket-policy-support-external-content-connector__ul_actions_effects} The connector checks a statement for unsupported elements only after it confirms that the statement applies to the content item's resource and to the read action. A statement that uses an unsupported condition under an unrelated action, such as `s3:PutObject`, or that applies to a different prefix, doesn't affect the content item. ## Supported principals {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-principals} The connector resolves principals against the Identity and Access Management (IAM) users and roles that it crawls. * User and role Amazon Resource Names (ARNs): The connector grants access to the named user or role. * Wildcard principal (`"*"`): The connector grants access to the identities it crawled in your AWS account, not to everyone in ServiceNow AI Platform. * Account root (`arn:aws:iam:::root`): The connector grants access to the crawled users of that account. Account roots from other accounts don't grant access to anyone, because the connector doesn't retrieve the identities of other accounts. {#amazon-s3-bucket-policy-support-external-content-connector__ul_principals} When many users need access to a content item, create an IAM role for the group of users and grant access to the role instead. This approach lists one role in the bucket policy, instead of many individual IAM users. ## Supported condition keys {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-condition-keys} The connector supports only condition keys whose value follows from the crawled principal, with no extra AWS call. {#amazon-s3-bucket-policy-support-external-content-connector__table_condition_keys__entry__2} | Condition key | Value the connector uses | |-|-| | `aws:PrincipalArn` | The ARN of the user or role. The connector normalizes an assumed-role session ARN to the role ARN. | | `aws:username` | The IAM user name. This key is absent for roles and for the account root. | | `aws:PrincipalAccount` | The 12-digit account ID, parsed from the ARN. | | `aws:PrincipalType` | `User`, `AssumedRole`, or `Account`, derived from the shape of the ARN. | [Table 1. Supported condition keys] {#amazon-s3-bucket-policy-support-external-content-connector__table_condition_keys} The connector doesn't support any other condition key. Examples of unsupported keys include `aws:userid`, `aws:PrincipalTag/*`, `aws:ResourceTag/*`, `aws:PrincipalOrgID`, `aws:PrincipalOrgPaths`, network keys such as `aws:SourceIp` and `aws:SourceVpc`, session keys such as `aws:MultiFactorAuthPresent` and `aws:SecureTransport`, time keys such as `aws:CurrentTime`, call-chain keys such as `aws:CalledVia`, and keys that start with `s3:`. When a condition key doesn't exist for a principal, the result depends on the operator. A positive operator, such as `StringEquals` or `ArnLike`, fails unless you add the `IfExists` suffix, in which case it passes. A negated operator, such as `StringNotEquals` or `ArnNotLike`, passes either way. As an example, `aws:username` doesn't exist for a role, so a statement that requires `aws:username` to equal a value doesn't grant access to roles. ## Supported operators {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-operators} The connector supports the following operators, each also with the `IfExists` suffix: * String operators: `StringEquals`, `StringNotEquals`, `StringLike`, `StringNotLike`. * ARN operators: `ArnEquals`, `ArnNotEquals`, `ArnLike`, `ArnNotLike`. {#amazon-s3-bucket-policy-support-external-content-connector__ul_operators} The ARN operators match patterns segment by segment, as AWS does. A `*` doesn't match across a colon, so `arn:aws:iam::*` doesn't match `arn:aws:iam::123456789012:user/alice`. The connector doesn't support the following operators and qualifiers: `Bool`, `Null`, the `Date` operators, `IpAddress`, `NotIpAddress`, the `Numeric` operators, `StringEqualsIgnoreCase`, `StringNotEqualsIgnoreCase`, and the `ForAnyValue:` and `ForAllValues:` set qualifiers. Condition values that contain a policy variable, such as `${aws:username}`, aren't supported either. ## Unsupported policy elements and messages {#amazon-s3-bucket-policy-support-external-content-connector__amazon-s3-bucket-policy-support-unsupported} The connector doesn't support the `NotPrincipal`, `NotAction`, and `NotResource` elements. If a policy statement that applies to a content item contains an unsupported element, condition key, operator, or policy variable, the connector doesn't index the content item. It sets the content item to "filtered out" and records one of the following informational messages. The connector doesn't make a best-effort evaluation or a partial evaluation. When the connector can't determine who can see a content item, it indexes nothing, to help avoid exposing a content item to a user who shouldn't see it. {#amazon-s3-bucket-policy-support-external-content-connector__table_unsupported_messages__entry__2} | Message | Meaning | |-|-| | `unsupported condition: ` | The statement uses a condition key or policy element that the connector doesn't support. For example, `unsupported condition: aws:userid`. | | `unsupported operator: ` | The statement uses an operator that the connector doesn't support. For example, `unsupported operator: IpAddress`. | | `unsupported policy variable: ` | A condition value contains a policy variable, such as `${aws:username}`. | [Table 2. Filtered-out messages] {#amazon-s3-bucket-policy-support-external-content-connector__table_unsupported_messages} A role's trust policy that the connector can't evaluate has a different effect. The connector doesn't filter content items. Instead, it treats the role as having fewer members, or none, and continues the crawl. **Related concepts** * [Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/XinjV_Wgm9lOHKuXasVRrg "The Amazon S3 external content connector offers multiple permission modes to control which users can see its crawled content items in AI Search applications.") **Related reference** * [AWS permissions required for Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/JBIwc72RaFhysoiiuhsWrg "The Identity and Access Management (IAM) user for an Amazon S3 external content connector requires Amazon S3 and IAM permissions that depend on the permission mode.")