# fetch a data hosted in a S3 bucket

The customer wants to use a playbook to fetch a data hosted in a S3 bucket on his own account.

   <div class="docs-screenshot-compact">

   ![Customer wants use playbook fetch data](./assets/shot-01.png)

   </div>

## Solutions

## AWS Credentials

   <div class="docs-screenshot-compact">

   ![Aws credentials](./assets/aws-credentials.png)

   </div>

### AWS Configuration

The customer needs to create an IAM user. For that he should go under **IAM** and click on **Add users**

   <div class="docs-screenshot-compact">

   ![Aws configuration](./assets/aws-configuration.png)

   </div>

Then choose a name for the user and grant him an **Access key**

   <div class="docs-screenshot-compact">

   ![Aws configuration](./assets/aws-configuration-2.png)

   </div>

Then set the rights. In this example we create a user that will access all S3 buckets in read only. For additional security, a boundary could be set, for example the rights could be restricted to a single bucket.

   <div class="docs-screenshot-compact">

   ![Aws configuration](./assets/aws-configuration-3.png)

   </div>

Add some tags

   <div class="docs-screenshot-compact">

   ![Aws configuration](./assets/aws-configuration-4.png)

   </div>

Review the user and click on **create user**

   <div class="docs-screenshot-compact">

   ![Aws configuration](./assets/aws-configuration-5.png)

   </div>

### Mindflow Configuration

In the **Vault**, create a **new credential**.

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-2.png)

   </div>

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-3.png)

   </div>

In **Credential type**, select **AWS Signature V4**.

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-4.png)

   </div>

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-5.png)

   </div>

Fill the configuration form with the previously created access key and secret.

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration.png)

   </div>

You’re **done** ! You can configure any AWS S3 step with this credential.

## AWS Assume Role Credentials

   <div class="docs-screenshot-compact">

   ![Aws assume role credentials](./assets/aws-assume-role-credentials.png)

   </div>

### Retrieve Mindflow’s AWS account id

In the **Vault**, create a **new credential**.

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-2.png)

   </div>

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-3.png)

   </div>

In **Credential type**, select **AWS Assume Role**.

   <div class="docs-screenshot-compact">

   ![Mindflow configuration](./assets/mindflow-configuration-4.png)

   </div>

   <div class="docs-screenshot-compact">

   ![Retrieve mindflows aws account id](./assets/retrieve-mindflows-aws-account-id.png)

   </div>

Once selected, Mindflow **account id** will appear as an item of the configuration form.

   <div class="docs-screenshot-compact">

   ![Retrieve mindflows aws account id](./assets/retrieve-mindflows-aws-account-id-2.png)

   </div>

Copy the id and save Mindflow’s tab for later. We need to create a **role** in the **AWS Console** before going further.

### Create the AWS IAM role

Create a **Role** under **IAM.**

   <div class="docs-screenshot-compact">

   ![Create aws iam role](./assets/create-aws-iam-role.png)

   </div>

Then add the Mindflow AccountId as the **trusted entity.**

   <div class="docs-screenshot-compact">

   ![Create aws iam role](./assets/create-aws-iam-role-2.png)

   </div>

Then add the appropriate rights to the role. In this example we add S3ReadOnly access role.

   <div class="docs-screenshot-compact">

   ![Create aws iam role](./assets/create-aws-iam-role-3.png)

   </div>

Review and **Create role.**

   <div class="docs-screenshot-compact">

   ![Create aws iam role](./assets/create-aws-iam-role-4.png)

   </div>

### Create the credential

Back in Mindflow’s tab, fill the rest of the form with the created role’s ARN. Also make sure that the correct region and service are used.

   <div class="docs-screenshot-compact">

   ![Create credential](./assets/create-credential.png)

   </div>

Finally the appropriate AWS service can be used.

   <div class="docs-screenshot-compact">

   ![Create credential](./assets/create-credential-2.png)

   </div>