> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# AWS S3 integration

Data export

Data export actions

The AWS S3 integration lets you forward data to an S3 bucket further analysis. This lets you leverage HUMAN data alongside your existing logs and metrics within your AWS instance. You can use the AWS S3 integration to create a [data export](/applications/create-a-data-export) or trigger it with a [data export action](/applications/data-export-actions).

> **Note**
>
> AWS S3 only supports sending [Logs](/applications/data-schema-logs) data.

## Prerequisites

* If you're using the **Access Key** method, the S3 bucket access key ID and secret access key.
* Appropriate [role permissions](/applications/role-permissions) to create and manage integrations

## Integrate with AWS S3

1. Navigate to **Platform Settings > Integrations** and click the **AWS S3** integration.
2. Click **Add Integration.**
3. Provide an **Integration name.**
4. Select an **Access method** and complete the fields that appear. Click the appropriate option below for more information on their fields.
   #### Access Key
   With this method, you provide HUMAN your S3 bucket's access key ID and secret access key.
   * **Integration name:** How the integration will appear in your HUMAN account.
   * **Bucket:** The name of the S3 bucket to send data to.
   * **Region:** The AWS region the bucket resides at.
   * **SSE:** Select a bucket encryption method.
   * **Access Key ID:** The S3 bucket access key ID.
   * **Secret Access Key:** The S3 bucket secret access key.
   * **Path pattern:** The file's path. This does not affect the file name. See [supported path patterns](#supported-path-patterns) for details.
   #### ARN Role
   With this method, you update your bucket's policy with HUMAN's [AWS IAM ARN](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns) information.
   * **Bucket:** The name of the S3 bucket to send data to.
   * **Region:** The AWS region the bucket resides at.
   * **SSE:** Select a bucket encryption method.
   * **Path pattern:** The file's path. This does not affect the file name. See [supported path patterns](#supported-path-patterns) for details.
5. If you chose the **ARN Role** method, follow [AWS' instructions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html) to edit your bucket's policy with the following. Otherwise, skip to **Step 6.**
   * `"Sid": "AllowHSDataExportRole"`
   * `"AWS": "arn:aws:iam::442426886265:role/HSDataExport"`
   * Replace `YOUR_BUCKET_NAME` with the same bucket name you provided in **Step 4.**
   #### Full bucket policy example
   ```json
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "AllowHSDataExportRole", // HUMAN value
         "Effect": "Allow",
         "Action": "s3:*",
         "Principal": {
           "AWS": "arn:aws:iam::442426886265:role/HSDataExport" // HUMAN ID and role
         },
         "Action": [
           "s3:GetObject",
           "s3:PutObject",
           "s3:ListBucket",
         ],
         "Resource": [
           "arn:aws:s3:::YOUR_BUCKET_NAME", // Same bucket name as you provided in the HUMAN console
           "arn:aws:s3:::YOUR_BUCKET_NAME/*" // Same bucket name as you provided in the HUMAN console
         ]
       }
     ]
   }
   ```
6. Click **Test Connection.**
7. Once the test succeeds, click **Save changes.**

You have successfully configured an AWS S3 integration. Make sure to use the integration to create a [data export](/applications/create-a-data-export) or trigger it with a [data export action](/applications/data-export-actions).

## Supported path patterns

| Pattern   | Path Value            | Example      |
| --------- | --------------------- | ------------ |
| `{yyyy}`  | Four digit year value | `2022`       |
| `{mm}`    | Two digit month value | `02`         |
| `{dd}`    | Two digit day         | `16`         |
| `{appId}` | Activity's App ID     | `PX12AB34CD` |

Path patterns allow the following characters:

* `a-z`
* `A-Z`
* `0-9`
* `-`, `/`, `!`, `\`, `_`, `.`, `\`, `*`, `'`, `()`

For example, for the date February 2, 2022, the path pattern would resolve to: `2022/02/16/production/PX12AB34CD`.

## File name patterns

File names generated by HUMAN follow the following pattern: `{guid}_{appId}_{startTimestamp}_{endTimestamp}`.

For example, for a file name of `7bd6079a-b5e4-4788-93c5-b939549ce5be_PX3tHq532g_1645014120000000000_1645014180000000000**`, the values would be:

* GUID: `7bd6079a-b5e4-4788-93c5-b939549ce5be`
* App ID: `PX3tHq532g`
* Start timestamp (UNIX epoch): `1645014120000000000`
* End timestamp (UNIX epoch): `1645014180000000000`