--- sourceDocument: Brazil ServiceNow AI Platform Administration sourceDocumentLink: https://www.servicenow.com/docs/r/platform-administration Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # Amazon S3 external content connector permission modes # Amazon S3 external content connector permission modes {#ariaid-title1} Release version: Brazil Updated October 28, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read The Amazon S3 external content connector offers multiple permission modes to control which users can see its crawled content items in AI Search applications. When an Amazon S3 external content connector indexes a content item, it records which users and groups are allowed to see that content item. AI Search uses these permissions to show each user only the search results they have access to in the source system. In standard user permission crawl mode, the connector respects the permission model of your Amazon S3 source system. Two simpler modes are available for use with source systems that have broad content visibility across your organization. {#amazon-s3-permission-modes-external-content-connector__table_permission_modes__entry__4} | Mode | How you select it on the user mappings page | What the user permission crawl retrieves | Who can see crawled content | |-|-|-|-| | Standard user permission crawl | Clear the Override all document permissions option. | Identity and Access Management (IAM) users, roles, and groups | The users and role groups that the bucket policy grants access to, plus the IAM groups whose policies grant access. | | User permission crawl with a connector-created group of all retrieved users | Select the Override all document permissions option, then select All Mapped Users. | IAM users only | Every crawled IAM user, through one group that the connector creates automatically. The connector doesn't evaluate bucket policies. | | No user permission crawl | Select the Override all document permissions option, then select Existing SN Group and specify an existing ServiceNow AI Platform group. | Nothing | The members of the group you select. | [Table 1. Permission modes] {#amazon-s3-permission-modes-external-content-connector__table_permission_modes} Important: When you upgrade from a previous release that doesn't support user permissions, your existing Amazon S3 external content connector has no permission mode specified. Until you set one of the listed permission modes for the connector, everyone who has access to your configured AI Search experience can see all content retrieved by the connector. Each content crawl records a warning reminding you to select a permission mode. For details on setting a permission mode for your connector, see [Configure permission mode and user mapping settings for an Amazon S3 external content connector](https://www.servicenow.com/docs/eV8my9H~XQkUdf9hKhinpQ "Select the permission mode that controls which users can see content crawled by an Amazon S3 external content connector, and specify user mapping if needed."). ## Standard user permission crawl {#amazon-s3-permission-modes-external-content-connector__amazon-s3-permission-modes-external-content-connector-standard} In this mode, the connector reads the bucket policy for each bucket and determines which users and groups can read each retrieved content item. A user permission crawl maps each IAM user to a user in your ServiceNow AI Platform instance. For details about mapping, see [Configure user mapping settings for an external content connector](https://www.servicenow.com/docs/wTXv4ixUOHOWBfQaVS61Gg "Override the default field mappings for an external content connector's user permission crawls. Specify the fields that uniquely identify user security principals in your source system and users in your ServiceNow AI Platform instance. Optionally execute a custom script to transform security principal IDs before they're compared with the IDs of users in your instance."). The connector also evaluates the identity policies of your IAM groups, so a group that grants read access to objects gives that access to its members even when a bucket has no policy. If a statement in the bucket policy denies access, the deny takes precedence over any allow. Important: If a bucket has no policy, or the connector can't read its policy, content from that bucket is indexed but not visible to any user. The crawl records a warning that names the bucket. Connectors that indexed content from such buckets before permission modes were available no longer return that content in search results after you select this mode. If a bucket policy statement that applies to a content item uses a condition or operator that the connector doesn't support, the connector doesn't index that item. Instead, it sets the content item to "filtered out" and records an informational message. To learn which policy elements the connector supports, see [Amazon S3 bucket policy elements supported by the external content connector](https://www.servicenow.com/docs/H~oz2TfQ8ONtuvKtFgb7Iw "In a standard user permission crawl, the Amazon S3 connector evaluates only the policy elements listed here. It doesn't index content items with policy statements that use other elements."). The connector doesn't read the following sources of access, so content that is available to a user only through them isn't reflected in search permissions: * Identity-based policies attached directly to an IAM user * Per-object access control lists (ACLs) in Amazon S3 * Access that a user gets by assuming a role through another role (role chaining) * Access limits specified in service control policies (SCPs) {#amazon-s3-permission-modes-external-content-connector__ul_standard_limits} ## User permission crawl with a connector-created group of all retrieved users {#amazon-s3-permission-modes-external-content-connector__amazon-s3-permission-modes-external-content-connector-all-users} Use this mode to make all retrieved content items visible to every user that the connector retrieves on its user permission crawl. The connector lists the IAM users in your AWS account, adds all of them to one group that the connector creates, and makes every indexed content item visible to all members of that group. The connector doesn't fetch or evaluate bucket policies in this mode. If the AWS source system has no IAM users, all content items are filtered out and no one can see the connector's indexed content in AI Search applications. ## No user permission crawl with an existing group {#amazon-s3-permission-modes-external-content-connector__amazon-s3-permission-modes-external-content-connector-existing-group} Use this mode when you already have a ServiceNow AI Platform group that contains the users who should see the retrieved content. The connector doesn't run a user permission crawl and doesn't require any IAM permissions. Every indexed content item is visible to the members of the group you select. Group memberships are synced by a queued event and the XCC Sync domain-public groups scheduled job, which runs every 15 minutes by default. Changes to group memberships don't affect visible search results until the scheduled job's next run. **Related concepts** * [Amazon S3 external content connector](https://www.servicenow.com/docs/Mg1babnwZSM999piYVYTbw "The Amazon S3 external content connector makes content and metadata from your Amazon S3 buckets searchable in AI Search applications.") **Related tasks** * [Configure permission mode and user mapping settings for an Amazon S3 external content connector](https://www.servicenow.com/docs/eV8my9H~XQkUdf9hKhinpQ "Select the permission mode that controls which users can see content crawled by an Amazon S3 external content connector, and specify user mapping if needed.") **Related reference** * [Amazon S3 bucket policy elements supported by the external content connector](https://www.servicenow.com/docs/H~oz2TfQ8ONtuvKtFgb7Iw "In a standard user permission crawl, the Amazon S3 connector evaluates only the policy elements listed here. It doesn't index content items with policy statements that use other elements.") * [AWS permissions required for Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/JBIwc72RaFhysoiiuhsWrg "The Identity and Access Management (IAM) user for an Amazon S3 external content connector requires Amazon S3 and IAM permissions that depend on the permission mode.")