AWS S3 modules

For more detail about the information in this table, see Access requirements in documentation.

For information on Adobe Workfront Fusion licenses, see Adobe Workfront Fusion licenses.

• Prerequisites to connecting AWS to Workfront Fusion using a federated connection
• Add Workfront Fusion as an identity provider in AWS
• Create the IAM role
• Create the connection in Workfront Fusion
• Add the connection to the role’s trust policy
• Verify the connection
• Troubleshooting

A federated connection lets Workfront Fusion access your AWS account without you creating an IAM user or storing an access key in Fusion.
Instead, you register Workfront Fusion as a trusted identity provider in your AWS account, and you configure which single Fusion connection is allowed to use a particular IAM role. When the connection runs, Fusion presents a short-lived proof of identity, and AWS returns temporary credentials that expire on their own. No long-lived key is ever created, stored, or rotated.

Prerequisites to connecting AWS to Workfront Fusion using a federated connection

To create this connection, you need the following:

• Permission in AWS IAM to create an identity provider and to create and edit roles. This usually means the policy or equivalent. If you do not have this access, ask someone on your cloud or
  security team to complete the AWS steps for you.
• The ability to create connections in Workfront Fusion.

Add Workfront Fusion as an identity provider in AWS

This step tells AWS that tokens issued by Workfront Fusion can be trusted. You do this once per AWS account. If someone in your organization has already added this provider, skip to Create the IAM role.

1. Sign in to the AWS console and go to IAM > Identity providers.

2. Select Add provider.

3. For Provider type, select OpenID Connect.

4. In Provider URL, enter the following, then select Get thumbprint:

   code language-none
   https://oidc.automations.adobe.com

5. In Audience, enter the following:

   code language-none
   sts.amazonaws.com

6. Select Add provider.

7. Continue to Create the IAM role.

Create the IAM role

The role defines what the connection is allowed to do in your AWS account. You create one role per connection, so that each connection’s access can be granted and revoked independently.

1. In IAM, go to Roles and select Create role.

2. For Trusted entity type, select Web identity.

3. In Identity provider, select oidc.automations.adobe.com.

4. In Audience, select sts.amazonaws.com.

5. Select Next, then attach the permissions policies this connection needs.
   Grant only the permissions the connection actually uses. For example, a connection that only reads from
   one bucket does not need AmazonS3FullAccess.

6. Give the role a clear, recognizable name. For example, WorkfrontFusionFederatedConnection.

7. Select Create role.

8. Open the role you just created and copy its ARN from the Summary area. It looks like this: arn:aws:iam::123456789012:role/WorkfrontFusionFederatedConnection

9. Continue to Create the connection in Workfront Fusion.

Create the connection in Workfront Fusion

1. In the module’s connection setup screen, select the federated connection type.
2. Enter the Role ARN you copied in Create the IAM role.
3. Select Create.
   Workfront Fusion displays three values. You use them in the next procedure.

1. Leave this panel open and copy the Subject value.

   note
   NOTE
   Do not close the panel or select Cancel. The connection is not finished until you complete the remaining procedures. If you close the panel, you must delete the connection and start again, because a new connection receives a new Subject.

2. Continue to Add the connection to the role’s trust policy.

Add the connection to the role’s trust policy

Until you complete this procedure, the role trusts Workfront Fusion in general but does not yet allow this specific connection to use it.

1. In a new browser tab, return to the AWS console and open the role you created.

2. Select the Trust relationships tab, then select Edit trust policy.

3. Replace the policy with the following, substituting your own values:

   • Replace 123456789012 with your AWS account ID
   • Replace the sub value with the Subject you copied from Workfront Fusion.

   code language-none
   { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.automations.adobe.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "oidc.automations.adobe.com:sub": "fusion:6e5b1c2a345bd8d1ed98b6b4f1459818:28964", "oidc.automations.adobe.com:aud": "sts.amazonaws.com" } } } ] }

4. Select Update policy.

5. Continue to Verify the connection.

"oidc.automations.adobe.com:sub": [ "fusion:6e5b1c2a345bd8d1ed98b6b4f1459818:28964", "fusion:6e5b1c2a345bd8d1ed98b6b4f1459818:29011"
    ]

Verify the connection

1. Return to the Workfront Fusion browser tab, where the connection panel is still open.

2. Click Save.

   Workfront Fusion contacts AWS, which checks the trust policy and returns temporary credentials. If everything is set up correctly, the connection validates successfully and you can proceed with setting up the module.
   If verification fails, the panel stays open and displays the error. Correct the problem in AWS and select Save again. You do not need to recreate the connection, and the Subject does not change.

From this point on, the connection renews its own credentials. There is no key to rotate and nothing expires that you need to maintain.

Troubleshooting

To connect AWS S3 to Workfront Fusion you must connect your AWS account to Workfront Fusion. To do so, you’ll first need to create an API user in AWS IAM.

1. Sign in to your AWS IAM account.

2. Navigate to Identity and Access Management > Access Management > Users.

3. Click Add User.

4. Enter the name of the new user and select the Programmatic access option in the Access type section.

5. Click Attach existing policies directly, then search for AmazonS3FullAccess in the search bar. Click it when it appears, then click Next.

6. Proceed through the other dialog screens, then click Create User.

7. Copy the provided Access key ID and Secret access key.

8. Go to Workfront Fusion and open the AWS S3 module’s Create a connection dialog.

9. Enter the Access key ID and Secret access key from step 7 to the respective fields and click Continue to establish the connection.

The connection has been established. You can proceed with setting up the module.