> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stigg.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon S3

## Overview

Stigg's integration with Amazon S3 allows you to export your product catalog, customer, and subscription data to an S3 bucket as structured files — useful for data lake pipelines, custom ETL workflows, or archival.

<Note>
  Stigg's native data export integrations are included in the Scale plan, and are also available as an optional add-on to the Growth plan. See Stigg's pricing for more details.
</Note>

<Card title="View the full entity schema" icon="sitemap" href="./schema">
  See every table and column exported to your destination, organized by entity group.
</Card>

## Setting up the integration

### Prerequisites

* An AWS account with permission to create S3 buckets and IAM roles/policies.
* Access to the Stigg dashboard with permission to configure integrations.

<Note>
  Use a dedicated bucket for this integration to avoid resource contention and to keep its access policies tightly scoped.
</Note>

<Steps>
  <Step title="Create the S3 bucket">
    In the [AWS S3 console](https://console.aws.amazon.com/s3/), create a bucket with:

    * **Object Ownership**: ACLs disabled
    * **Block Public Access settings**: Block all public access

    Note the bucket name and AWS region — you'll need them later.
  </Step>

  <Step title="Create the IAM policy and role">
    In the [AWS IAM console](https://console.aws.amazon.com/iam/), go to **Policies → Create policy**, click the **JSON** tab, and paste the following, replacing `BUCKET_NAME`:

    <CodeGroup>
      ```json IAM policy theme={null}
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": ["s3:PutObject"],
                  "Resource": "arn:aws:s3:::BUCKET_NAME/*"
              }
          ]
      }
      ```
    </CodeGroup>

    <Note>
      Optionally add `s3:DeleteObject` to the `Action` list to allow automatic cleanup of the test file written during connection setup.
    </Note>

    If the bucket uses KMS encryption, also add a statement granting `kms:GenerateDataKey` and `kms:Decrypt` on your CMK, replacing `REGION_NAME`, `ACCOUNT_ID`, and `KEY_ID`:

    <CodeGroup>
      ```json KMS statement theme={null}
      {
        "Effect": "Allow",
        "Action": [
          "kms:GenerateDataKey",
          "kms:Decrypt"
        ],
        "Resource": "arn:aws:kms:REGION_NAME:ACCOUNT_ID:key/KEY_ID"
      }
      ```
    </CodeGroup>

    Then go to **Roles → Create role**, select **Custom trust policy**, and paste the trust policy shown in the Stigg connect form — it will look like this, with the organization and service-account identifiers pre-filled for your account:

    <CodeGroup>
      ```json Trust policy theme={null}
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "sts:AssumeRoleWithWebIdentity"
            ],
            "Principal": {
              "Federated": "accounts.google.com"
            },
            "Condition": {
              "StringEquals": {
                "accounts.google.com:oaud": "<some_organization_identifier>",
                "accounts.google.com:sub": "<some_service_account_identifier>"
              }
            }
          }
        ]
      }
      ```
    </CodeGroup>

    Click **Next**, attach the permissions policy created above, click **Next** again, give the role a name (e.g. `transfer-role`), and click **Create role**. Open the created role and note its **ARN** — you'll need it in the next step.
  </Step>

  <Step title="Connect Stigg with S3">
    In [Stigg](https://app.stigg.io/), navigate to **Integrations > Apps > Amazon S3**.

    Enter the following information in the connection form:

    | Field         | Description                                |
    | ------------- | ------------------------------------------ |
    | Bucket name   | The name of your S3 bucket                 |
    | Bucket region | The AWS region where the bucket is located |
    | Role ARN      | The ARN of the IAM role created above      |

    Click **Test & connect**.

    <Note>
      If your organization's policy rules out role-based access, you can instead authenticate with an **Access key ID** and **Secret access key** for an IAM user with the same `s3:PutObject` permissions on the bucket.
    </Note>
  </Step>

  <Step title="Select entities to export">
    After entering your connection details, expand the **Entities to export** section to choose which entity groups to include in the sync. All groups are selected by default.

    See [Exported entities](./overview#exported-entities) for a description of each group.
  </Step>
</Steps>


## Related topics

- [Exported entities](/documentation/importing-and-exporting-data/export/overview.md#exported-entities)
- [Sync process, schedule, manual sync, and sync history](/documentation/importing-and-exporting-data/export/overview.md#sync-process)