Configure AWS permissions for audience sourcing

Use this guide to configure AWS Identity and Access Management (IAM) policies and roles that grant Adobe secure, read-only access to your Amazon S3 bucket. This access enables Real-Time CDP Collaboration to source audiences from your S3 bucket.

Prerequisites prerequisites

Before continuing, confirm that you meet the following requirements and have access to the required information.

Required AWS permissions

To complete this setup, your account must have AWS administrator access. Administrator access ensures that you can create and manage IAM policies and roles required to authorize Adobe’s access to your S3 bucket. If you do not have administrator privileges, contact your AWS administrator before proceeding.

Required information

As you go through the steps below, keep note of the following information. These details are used in the Amazon S3 audience sourcing UI guide.

arn:aws:s3:::<bucket-name>/<optional-folder-path>

Create an IAM policy create-policy

To begin the setup, first create an IAM policy that grants read-only access to your S3 bucket. This policy allows Adobe to read the files necessary for audience sourcing but does not grant write or delete permissions.

Open the AWS Management Console, and navigate to IAM > Policies > Create policy.

In the AWS Create policy workspace, select the JSON tab and paste the following example policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": "<Your AWS ARN for bucket folder path>"
    },
    {
      "Sid": "Statement2",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "<Your AWS ARN for bucket>"
    }
  ]
}

Review the policy settings and select Create policy. Record the policy name for use in a later step.

Create an IAM role create-role

Next, create an IAM role and set the Real-Time CDP Collaboration AWS IAM role as the trusted entity. This enables Adobe’s services to assume the role and securely read your S3 audience data.

In the IAM tab of the Amazon S3 Management Console, navigate to Roles > Create role.

Under Step 1 of the Create role workflow, in the Trusted entity type section, select Custom trust policy. Then, in the Custom trust policy editor, paste the following example and replace <Adobe IAM Role ARN> with the value for your region.

An example trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<Adobe IAM Role ARN>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Review the policy and select Next to continue.

In Step 2 Add permissions section of the Create role workflow, search for and attach the IAM policy you created earlier. Select the policy followed by Next to continue to Step 3.

In the Step 3 Name review, and create - Role details section, provide a role name (for example, s3-iam-role) and optional description.

This page displays the trusted entity policy, the permissions policy summary, and any tags you may have added for internal organization and tracking.

Finally, select Create role to confirm the setup.

Next steps next-steps

This setup grants Adobe read-only access to your S3 bucket and establishes a trusted connection with Adobe’s IAM role.

Next, proceed to Configure AWS S3 for audience sourcing to connect your S3 bucket to Collaboration.

For more information about sourcing audiences, refer to Source and manage audiences.