Set Up Amazon S3 in Kizen

Learn how to configure the Amazon S3 integration in Kizen to work with live S3 data in Agentic Workflows.

Audience: Admins, Developers, Solution Architects

Purpose: Explains how to configure the connection between Amazon S3 and Kizen

Overview

Caution: This setup reflects Kizen's default configuration. Your administrator may have customized your layout, so columns or navigation may appear differently. Trial accounts may have limited features.

Connect Amazon Simple Storage Service (S3) to Kizen through the Amazon S3 integration.

---

Before You Begin

To set up Amazon S3 in Kizen, you need:

• Any standard Amazon Web Services (AWS) account with at least one active S3 bucket
• Org Admin access in Kizen

---

Set Up Amazon S3 in Kizen

To set up Amazon S3 in Kizen:

1

Create an IAM policy

From the IAM Dashboard in the AWS Management Console, create a new IAM policy for your Amazon Web Services account. The IAM policy is a JSON object that determines the permissions to grant the integration:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::bucket_name"
    },
    {
      "Sid": "ReadWriteObjects",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::bucket_name/*"
    },
    {
      "Sid": "ReadOnlySourceBucket",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::source_bucket_name/*"
    }
  ]
}

The following table lists the permissions to grant depending on how you want to use the integration.

Integration action	IAM permissions	Resource level to grant on
Upload File	s3:PutObject	Object
Get File Content	s3:GetObject, s3:GetObjectVersion	Object
Get File Metadata	s3:GetObject, s3:ListBucket	Object
List Files	s3:ListBucket	Bucket
Copy File	s3:GetObject on the source and destination, s3:PutObject on the destination only	Object, source bucket, destination bucket
Generate Presigned URL	s3:PutObject for upload links, s3:GetObject for download links	Bucket

For more information on creating the IAM policy, see the AWS documentation and the IAM JSON policy element reference.

2

Create an IAM user

Also from the IAM Dashboard, create a new IAM user, and attach the permission policy that you created in Step 1. This user becomes the user of the integration.

For more information on creating the IAM user, see the AWS documentation.

3

Create an access key for the IAM user

From the summary page for the new IAM user, create an access key. Select the access key type for a third-party service, and note the values for the access key ID and secret access key. You need these values for the integration secret in Step 6.

For more information on creating the access key, see the AWS documentation.

4

Go to the App Marketplace

In Kizen, go to the global navigation, and select Platform > App Marketplace.

5

Turn on the Amazon S3 integration

Find the Amazon S3 card, and turn on the integration.

The Update Integration Secret modal appears.

Note: To access the Update Integration Secret modal after initial setup, find the active Amazon S3 card in the App Marketplace, select Manage Secrets on the card to open the Secret Manager in Kizen, find the secret for the Amazon S3 integration, and select Edit from its action menu.

6

Enter your Amazon S3 connection credentials

In the Integration Secret field of the modal, enter your Amazon S3 connection credentials as a JSON object. The JSON object must contain aws_access_key_id and aws_secret_access_key, with the optional region key, nested within a tag that describes your S3 environment, like this:

{
  "prod": {
    "aws_access_key_id": "AKIA...",
    "aws_secret_access_key": "...",
    "region": "us-east-2"
  }
}

Store multiple environments like this:

{
  "prod": {
    "aws_access_key_id": "AKIA...",
    "aws_secret_access_key": "...",
    "region": "us-east-2"
  },
  "archive": {
    "aws_access_key_id": "AKIA...",
    "aws_secret_access_key": "...",
    "region": "us-east-2"
  }
}

For descriptions of the keys, see the following table:

Key	Type	Description	Required?
aws_access_key_id	String	The AWS access key ID for your IAM user	Yes
aws_secret_access_key	String	The AWS secret access key for your IAM user	Yes
region	String	The region code for the physical location of your AWS server	No

If you don't know the region of your server or the corresponding region code, you can find this information in the Amazon S3 Console. For more information, see the Amazon Simple Storage Service documentation.

Note: ​Kizen hides your secret once you submit it, so you can't append a new environment to an existing secret. You must re-enter the credentials for all your environments along with the new one. Consider keeping a secure record of each environment's connection details outside of Kizen so you can refer to the full set whenever you add a new environment.

7

Save the integration secret

Select Save.

---

What's Next

Continue to Work with Amazon S3 Files in an Agentic Workflow to learn how to include live S3 data in your Agentic Workflows.

Related Topics

• Amazon S3
• Work with Amazon S3 Files in an Agentic Workflow
• Troubleshoot Amazon S3

Amazon Web Services, AWS, Amazon Simple Storage Service, and Amazon S3 are trademarks of Amazon.com, Inc. or its affiliates. Kizen's Amazon S3 integration is not affiliated with, sponsored by, or endorsed by Amazon.com, Inc.