# Source: https://docs.velodb.io/cloud/4.x/management-guide/more/amazon-aws/create-data-credential

Version: 4.x

On this page

# Create a Data Credential

VeloDB adopts a storage-compute separation architecture, where data is
typically stored in object storage. To ensure that the warehouse can access
the underlying data properly, a Data Credential must be created in advance.
The core of a Data Credential involves creating an IAM policy and an IAM role.
VeloDB will automatically attach this role to the EC2 used by the VeloDB
warehouse. Below are the detailed steps.

## Step 1: Create an S3 Bucket​

First, you need to prepare an S3 Bucket. If you already have one, you can skip
this step and proceed to Step 2.

> **NOTE** The S3 bucket you use must be located in the same AWS region where
> your VeloDB warehouses are deployed. If you do not already have a bucket in
> that region, please create one before proceeding.

  1. Log in to the AWS S3 Console as a user with administrator privileges.
  2. Click the **Create bucket** button.
  3. On the **create bucket** page, set the following options:
     1. Enter a name for the bucket.
     2. Select the AWS region that you will use for your VeloDB warehouse deployment.
     3. Enable Bucket Versioning (recommended).
  4. Click **Create bucket**.
  5. Copy the bucket name to add to VeloDB console.

## Step 2: Create an IAM Policy​

After the S3 bucket is provisioned, create an IAM policy that grants read and
write access to the bucket.

  1. Log into the **[AWS IAM Console](https://console.aws.amazon.com/iam/)** as a user with administrator privileges.

  2. Click the **Policies** tab in the sidebar.

  3. Click the **Create policy** button.

  4. In the policy editor, click the **JSON** tab.

  5. Copy and paste the following access policy into the editor, replacing `<YOUR-BUCKET-NAME>` with the name of the S3 bucket you prepared in the previous step.
         
         {  
              "Version": "2012-10-17",  
              "Statement":  
              [  
                  {  
                      "Effect": "Allow",  
                      "Resource": "arn:aws:s3:::<YOUR-BUCKET-NAME>",  
                      "Action":  
                      [  
                          "s3:GetBucketLocation",  
                          "s3:GetBucketVersioning",  
                          "s3:PutBucketCORS",  
                          "s3:ListBucket",  
                          "s3:ListBucketVersions",  
                          "s3:ListBucketMultipartUploads"  
                      ]  
                  },  
                  {  
                      "Effect": "Allow",  
                      "Resource": "arn:aws:s3:::<YOUR-BUCKET-NAME>/*",  
                      "Action":  
                      [  
                          "s3:GetObject",  
                          "s3:GetObjectVersion",  
                          "s3:PutObject",  
                          "s3:DeleteObject",  
                          "s3:DeleteObjectVersion",  
                          "s3:AbortMultipartUpload",  
                          "s3:ListMultipartUploadParts"  
                      ]  
                  },  
                  {  
                      "Effect": "Allow",  
                      "Action":  
                      [  
                          "sts:AssumeRole"  
                      ],  
                      "Resource": "*"  
                  }  
              ]  
         }  
         

  6. Click the **Next** button.

  7. In the **Name** field, enter a policy name.(e.g.VeloDBDataStorageAccess)

  8. Click **Create policy**.

## Step 3: Create a Service IAM Role​

  1. Click the **Roles** tab in the IAM console sidebar.

  2. Click **Create role**.

     1. Trusted entity type: Select **AWS** service.
     2. Use cases: Select **EC2**.
     3. Click the **Next** button.
     4. Attach Permission Policies: In the policy search box, enter the name of the policy you created in Step 2.
     5. In the **role name** field, enter a role name. (e.g. **VeloDBDataStorageAccessRole**)
     6. Click **Create role**.
  3. Update the Role's Trust Relationships.

Now that you have created the role, you must update its trust policy to make
it self-assuming. In the IAM role you just created, go to the Trust
Relationships tab and edit the trust relationship policy as follows, replacing
the`<YOUR-AWS-ACCOUNT-ID>` and `<YOUR-ROLE-NAME>` values.

         
         {  
           "Version": "2012-10-17",  
           "Statement": [  
             {  
               "Effect": "Allow",  
               "Principal": {  
                 "Service": "ec2.amazonaws.com",  
                 "AWS": "arn:aws:iam::<YOUR-AWS-ACCOUNT-ID>:role/<YOUR-ROLE-NAME>"  
               },  
               "Action": "sts:AssumeRole"  
             }  
           ]  
         }  
         

  4. In the role summary, copy the **Instance Profile ARN** (format: arn:aws:iam::`<YOUR-AWS-ACCOUNT-ID>`:instance-profile/`<YOUR-ROLE-NAME>`) to add to VeloDB console.

On This Page

  * Step 1: Create an S3 Bucket
  * Step 2: Create an IAM Policy
  * Step 3: Create a Service IAM Role