Amazon S3

The Amazon S3 integration lets Una read data files directly from an S3 bucket in your AWS account. Una's Microsoft Fabric environment connects to the bucket and ingests the files, so you don't need to export or upload anything by hand.

The integration is read-only. Una can list and download files in the folder you choose, and nothing else. It can't write to, change or delete anything in your bucket.

This page is for the AWS administrator who will set up access on your side.

What it does

1. Gather your bucket details. You note the region, bucket, folder and encryption type.
2. Create read-only access. You create an IAM policy, a dedicated IAM user and an access key for Una.
3. Hand off. You securely send Una the bucket URL, folder path and access key.

Una then connects from Microsoft Fabric and reads the files.

Before you start

You'll need:

• Admin access to the AWS Management Console, with permission to create IAM policies, users and access keys.
• The S3 bucket that holds your data, with the files for Una in a dedicated folder. See Which files you can share.
• A secure way to share credentials, such as a password manager or a secure vault link. You'll use it in Step 5.

Which files you can share

S3 stores any type of file, and nothing in this setup depends on the file format. The access you create in the steps below works the same whatever you put in the folder.

The format only matters when Una brings the data in. Structured data files work best, for example:

• CSV (comma-separated values), with a header row and UTF-8 encoding
• Parquet
• JSON

Agree the format, file naming and how often you'll add files with the Una team before you start, so the ingestion can be set up to match. Keep each dataset's files in a consistent format and layout.

Step 1 — Gather your bucket details

Before you set up IAM, find and note the following:

Detail	What it is	Example
AWS Region	The region where the bucket is hosted	us-east-1
Bucket name	The exact name of the S3 bucket	company-analytics-data
Target folder	The folder path (prefix) that holds the files for Una	raw/telemetry/
Encryption	Whether the bucket uses Amazon S3 managed keys (SSE-S3) or AWS Key Management Service (SSE-KMS)	SSE-S3

You'll find the region and the default encryption on the bucket's Properties tab in the S3 console.

Step 2 — Create a read-only IAM policy

Una only needs to read from one folder in your bucket. Create a custom policy that grants exactly that, rather than using one of AWS's broader managed policies.

1. Sign in to the AWS Management Console and open the IAM service.
2. In the left navigation pane, select Policies, then click Create policy.
3. Switch to the JSON tab and paste the policy below.
4. Replace YOUR_BUCKET_NAME and YOUR_TARGET_FOLDER with your own values. Each appears more than once.
5. Click Next, give the policy a descriptive name such as UNAFabricS3IngestionPolicy, and click Create policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBucketListing",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "YOUR_TARGET_FOLDER/*",
                        "YOUR_TARGET_FOLDER"
                    ]
                }
            }
        },
        {
            "Sid": "AllowObjectDownload",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/YOUR_TARGET_FOLDER/*"
        }
    ]
}

tip

In the policy, write the folder without a leading or trailing slash. For example, if your folder is raw/telemetry/, replace YOUR_TARGET_FOLDER with raw/telemetry. The policy adds the /* itself.

The first statement lets Una list the files in your folder. The second lets Una download them. Neither grants access to anything outside the folder.

Step 3 — Create a dedicated IAM user

Create an IAM user just for Una, so you can see its activity separately and revoke its access without affecting anything else.

1. In the IAM console, go to Users and click Create user (in older versions of the console this button is called Add users).
2. Enter a descriptive username, such as svc-fabric-ingestion-una, and click Next.
3. Select Attach policies directly, search for the policy you created in Step 2 (UNAFabricS3IngestionPolicy), select it, and click Next.
4. Review the settings and click Create user.

The user doesn't need access to the AWS console. Una connects programmatically, using the access key you create next.

Step 4 — Create an access key

1. Click the user you just created (svc-fabric-ingestion-una) to open it.
2. Go to the Security credentials tab.
3. Scroll down to Access keys and click Create access key.
4. Select Third-party service as the use case, tick the confirmation box, and click Next.
5. Click Create access key.
6. Copy both the Access key ID and the Secret access key.

warning

AWS shows the secret access key once and never again. Copy it, or download the .csv file, before you close the page. If you lose it, deactivate and delete that key and create another. No harm done.

Treat the secret access key like a password. With the access key ID, it gives read access to your data.

Step 5 — Send your details to Una

Once setup is complete, send the following to your Una Microsoft Fabric integration team:

Detail	Description	Example
S3 URL (regional endpoint)	Your bucket's address, including its region	https://company-analytics-data.s3.us-east-1.amazonaws.com
Target folder (prefix)	The folder path that holds the files	raw/telemetry/
AWS access key ID	A 20-character alphanumeric key	AKIAIOSFODNN7EXAMPLE
AWS secret access key	A 40-character key	Send securely; see below

warning

Send the access key ID and secret access key through a secure, encrypted password manager or vault link. Don't send them by plain email, chat, or in a support ticket.

You can send the S3 URL and folder path by normal email. Only the keys need the secure channel.

Security and network considerations

Depending on how your AWS environment is secured, check the following before you hand off.

KMS encryption. If your bucket is encrypted with an AWS KMS customer managed key (CMK), the IAM user also needs permission to use that key. Update the key policy to allow the user to perform kms:Decrypt and kms:DescribeKey. Without this, Una can list your files but not read them. Buckets that use SSE-S3 (Amazon S3 managed keys) need no change.

Block Public Access. You can leave S3 Block Public Access turned on. Microsoft Fabric connects using authenticated HTTPS calls, not anonymous web access, so the bucket never needs to be public.

VPC restrictions. Make sure your bucket policy doesn't contain a blanket Deny for traffic from outside your VPC. Microsoft Fabric connects over the public internet unless an On-Premises Data Gateway is deployed inside your VPC. If your security policy requires VPC-only access, discuss this with the Una team before you start.

Day-two operations

• Adding files. Put new files in the same folder, in the format you agreed with Una. No AWS changes are needed.
• Changing the folder. Update the folder in the IAM policy from Step 2, then tell the Una team the new path.
• Rotating the access key. Create a second access key for the same user, send it to Una securely, and once Una confirms it's in use, deactivate and delete the old key. An IAM user can hold two keys at once, so there's no downtime.
• Revoking access. Deactivate or delete the access key, or delete the IAM user. Una's access stops immediately.

Troubleshooting

Una reports AccessDenied when listing files. The bucket name or folder in the IAM policy doesn't match the real ones. Check the spelling, and that the folder in the policy has no leading or trailing slash.

Una can list files but can't read them. The bucket is most likely encrypted with a KMS customer managed key, and the key policy doesn't yet allow the IAM user to use it. See KMS encryption.

Access is denied even though the IAM policy is correct. Check the bucket policy for a Deny statement that blocks traffic from outside your VPC, or from outside certain IP addresses. See VPC restrictions.

The connection fails with a region or endpoint error. Check that the region in the S3 URL matches the region shown on the bucket's Properties tab.

The secret access key was lost before it reached Una. Delete the key and create a new one, as in Step 4.

For anything else, see the official AWS Identity and Access Management documentation or contact your Una integration counterpart.