--- sourceDocument: Brazil ServiceNow AI Platform Administration sourceDocumentLink: https://www.servicenow.com/docs/r/platform-administration Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil ServiceNow AI Platform Administration ft:clusterId : - platadm bundleId : - platadm workflow : - Platform --- # Configure permission mode and user mapping settings # Configure permission mode and user mapping settings for an Amazon S3 external content connector {#ariaid-title1} Release version: Brazil Updated October 28, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Select the permission mode that controls which users can see content crawled by an Amazon S3 external content connector, and specify user mapping if needed. ## Before you begin A connector administrator must have already created the Amazon S3 external content connector that you need to configure. To learn about this procedure, see [Create an Amazon S3 external content connector](https://www.servicenow.com/docs/GanjELD3Hk3zMmZdANAYrw "Create an external content connector to retrieve searchable content from your Amazon S3 source system."). To use the standard user permission crawl or the all retrieved users group, your AWS administrator must have granted the connector's Identity and Access Management (IAM) user the permissions that the mode requires. To learn which permissions each mode requires, see [AWS permissions required for Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/JBIwc72RaFhysoiiuhsWrg "The Identity and Access Management (IAM) user for an Amazon S3 external content connector requires Amazon S3 and IAM permissions that depend on the permission mode."). Role required: sn_ext_conn.xcc_admin, plus ais_high_security_admin to modify user settings ## About this task The permission mode determines how the connector assigns access permissions to the content items it indexes. To learn about the available modes and choose the right one for your source system, see [Amazon S3 external content connector permission modes](https://www.servicenow.com/docs/XinjV_Wgm9lOHKuXasVRrg "The Amazon S3 external content connector offers multiple permission modes to control which users can see its crawled content items in AI Search applications."). ## Procedure 1. Navigate to AllExternal Content ConnectorsExternal Content Admin Home. {#configure-amazon-s3-permission-settings-external-content-connector__navigate-ext-content-connectors-admin-home-step} {#configure-amazon-s3-permission-settings-external-content-connector__navigate-ext-content-connectors-admin-home-step} 2. In the Connectors list, select the record for the Amazon S3 external content connector whose settings you need to modify. 3. In the connector editor's Settings tab, select User mapping settings. {#configure-amazon-s3-permission-settings-external-content-connector__select-user-mapping-settings-step} {#configure-amazon-s3-permission-settings-external-content-connector__select-user-mapping-settings-step} 4. Select the permission mode for the connector. * To use the standard user permission crawl, clear the Override all document permissions option. * To use a connector-created group of all retrieved users, select the Override all document permissions option, then select All Mapped Users. * To make all crawled content visible to users in an existing ServiceNow AI Platform group, select the Override all document permissions option, then select Existing SN Group, then select the group. {#configure-amazon-s3-permission-settings-external-content-connector__choices_permission_mode} {#configure-amazon-s3-permission-settings-external-content-connector__select-permission-mode-step} {#configure-amazon-s3-permission-settings-external-content-connector__select-permission-mode-step} 5. **Optional:** If you're using the standard user permission crawl or the connector-created group, review how the connector maps IAM users to users in your instance. In the Map from Amazon S3 section, the connector identifies each IAM user by the user name portion of the user's Amazon Resource Name (ARN), which is the final element in the ARN path. For example, for the ARN arn:aws:iam::123456789012:user/engineering/alice.smith, the identifier is alice.smith. The connector treats roles as groups. By default, the connector compares this identifier with the email field of the User \[sys_user\] table. If your instance identifies users differently, select a different field in the Map to ServiceNow section, or use a custom script to transform the identifier. As an example, if your instance users have email-based user names, you might append your domain name to the identifier: var mapSourceUser = function(sourceUserValue) { return sourceUserValue + "@example.com"; } mapSourceUser(sourceUserValue); For details about the mapping settings, the custom script, and testing your settings, see [Configure user mapping settings for an external content connector](https://www.servicenow.com/docs/wTXv4ixUOHOWBfQaVS61Gg "Override the default field mappings for an external content connector's user permission crawls. Specify the fields that uniquely identify user security principals in your source system and users in your ServiceNow AI Platform instance. Optionally execute a custom script to transform security principal IDs before they're compared with the IDs of users in your instance."). {#configure-amazon-s3-permission-settings-external-content-connector__map-arn-step} {#configure-amazon-s3-permission-settings-external-content-connector__map-arn-step} 6. If you selected the Override all document permissions option, select the I agree to the following disclaimer option. 7. Select Save and validate. {#configure-amazon-s3-permission-settings-external-content-connector__steps_permission_settings} ## Result The Amazon S3 external content connector is updated with your permission settings. ## What to do next Run a new content crawl for your connector to retrieve permissions for content items. If you selected the standard user permission crawl or the connector-created group, create and run a user permission crawl for the connector to retrieve IAM users and groups from your source system. To learn about creating and running user permission crawls, see [Create a user permission crawl for an external content connector](https://www.servicenow.com/docs/PxSR3RnjIPfm4mBx_1XqDQ "Retrieve security principals from your source system with a user permission crawl. Run the crawl as a one-time task or schedule it to run on a recurring basis."). If you selected an existing group, you don't need to run a user permission crawl. *[\>]: and then