Creating an S3 bucket for document requests

Creating the S3 bucket

1. Log in to your enterprise’s AWS web console and open S3

2. Click Create bucket

3. Enter new bucket settings
1. Enter a bucket name and select a region
🗒️
Make note of the bucket name and region that you use, as these will need to be communicated to your Confidencial technical contact to complete the set up process
2. Other settings can be adjusted in accordance with your enterprise’s security policies, though depending on the mode in which you configure Confidencial software to connect to your bucket, an access key with PUT and in some cases GET permissions may be required (see subsequent steps in this guide)

4. Click Create bucket

5. Click on the bucket you just created and under Permissions / Cross-origin resource sharing (CORS), click Edit

6. Paste in the JSON below and click Save changes

[
    {
        "AllowedHeaders": ["*"],
        "AllowedMethods": [
            "GET",
            "PUT",
            "POST",
            "DELETE",
            "HEAD"
        ],
        "AllowedOrigins": [
            "https://my.confidencial.io"
        ],
        "ExposeHeaders": ["ETag"]
    }
]

⚠️
The value for AllowedOrigins in the JSON above will be different for sandbox deployments. Your Confidencial technical contact will provide the correct value in these cases.

Setting up Confidencial bucket upload-only access via access key (no download access via key)

1. Create a new policy for bucket access. From IAM, click Policies on the left sidebar menu, then click Create policy.

2. Click JSON, then paste in the JSON below, replacing <bucket-name> with the name of the bucket you created in the previous section, then click Next

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ConfidencialBucketAccess",
			"Effect": "Allow",
			"Action": [
				"s3:putObject"
			],
			"Resource": [
				"arn:aws:s3:::<bucket-name>",
				"arn:aws:s3:::<bucket-name>/*"
			]
		}
	]
}

⚠️
NOTE: Replace aws with aws-us-gov in the above policy if creating the bucket in GovCloud

3. For Policy name, enter confidecial-bucket-put-access, then click Create policy

Setting up Confidencial user bucket download access through your enterprise IDP

1. If you haven’t done so already, create a user pool in AWS Cognito to enable your enterprise’s users to download directly from the S3 bucket using their enterprise IDP credentials. See
   🥸
   Creating a Cognito user pool to enable S3 bucket access via IDP credentials.

2. Open the role that was created in the previous step in AWS IAM. From IAM in the AWS Web Console, select Roles from the left sidebar menu, search for the role, and then click on it. If the instructions in the link in Step 1 above were followed, the role will be called confidencial-users.

3. Under Permissions policies select Add permissions > Create inline policy

4. Under Policy editor, select JSON

5. Paste the policy below into the Policy editor, replacing <bucket-name> with the name of the bucket you created in the first section

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "s3:getObject",
              "s3:listBucket"
            ],
            "Resource": [
              "arn:aws:s3:::<bucket-name>",
              "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

⚠️
NOTE: Replace aws with aws-us-gov in the above policy if creating the bucket in GovCloud

6. Click Next

7. For Policy name, enter confidecial-bucket-get-access, then click Create policy

Setting up Confidencial bucket upload and download access via access key

1. Create a new policy for bucket access. From IAM, click Policies on the left sidebar menu, then click Create policy.

2. Click JSON, then paste in the JSON below, replacing <bucket-name> with the name of the bucket you created in the previous section, then click Next

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ConfidencialBucketAccess",
			"Effect": "Allow",
			"Action": [
             "s3:getObject",
             "s3:listBucket",
             "s3:putObject"
			],
			"Resource": [
             "arn:aws:s3:::<bucket-name>",
             "arn:aws:s3:::<bucket-name>/*"
			]
		}
	]
}

⚠️
NOTE: Replace aws with aws-us-gov in the above policy if creating the bucket in GovCloud

3. For Policy name, enter confidecial-bucket-get-and-put-access, then click Create policy

Creating an access key for Confidencial bucket access

1. Create a new user for bucket access. From IAM, click Users on the left sidebar menu, then click Create user.

2. For User name, enter confidencial-bucket-access, then click Next

3. Under Permissions options, choose Attach policies directly, then click the checkbox next to the policy you created earlier (confidencial-bucket-...-access)
1. If Confidencial will upload and download via this access key, attach the confidecial-bucket-get-and-put-access policy
2. If Confidencial will only upload via this access key, attach the confidecial-bucket-put-access policy

4. Click Next

5. Click Create user

6. Select the user you just created (confidencial-bucket-access) and under Security credentials / Access keys, click Create access key

7. For Use case, select Application running outside AWS, then click Next

8. For Description tag value, enter Confidencial bucket access, then click Create access key
🗒️
Make note of the Access key and Secret access key. This is the only time that you will be able to see the secret key. Make sure that the secret key is stored in a secure location; this information will need to be securely transmitted to your Confidencial technical contact to complete the set up process.

9. Click Done
✅
This completes your portion of document request S3 bucket configuration. You will now need to securely transmit the following information to your Confidencial technical contact: bucket name, bucket region, access key, and secret access key.