AWS S3 Optimized Cross Account Connector

The AWS S3 Optimized Cross Account connector is a variant of the S3 Optimized connector. It reads logs from your S3 bucket using S3 event notifications sent to an SQS queue — but instead of using an Access Key and Secret Key, Bloo accesses your AWS account securely through an IAM role. You never need to share credentials. Bloo assumes the role using your Bloo Tenant ID as an External ID, which ensures only your Bloo tenant can access your account.

Before You Begin — Prerequisites

You will need the following before starting. Your S3 bucket must already exist and your Bloo Tenant ID must be available in your Bloo account settings.

Requirement	Where to Get It	Notes
AWS Account	Sign in at console.aws.amazon.com	Must have IAM admin access to create roles and policies
Bloo Tenant ID	Visible in the URL of any page after you log in to your Bloo Console	Previously known as cluster ID.
S3 Bucket	AWS Console → S3	Must already exist. Supported log formats: .json.gz, .log.gz, .txt.gz, .gz, .json, .txt, .log
SQS Queue	Created in Step 2 below	Must be a Standard queue in the same region as your S3 bucket. FIFO queues are not supported.
SQS Queue URL	AWS Console → SQS → your queue → Details tab	Format: https://sqs.[region].amazonaws.com/[account-id]/[queue-name]
Role ARN	Generated when you create the IAM role (Step 1 below)	Format: arn:aws:iam::[account-id]:role/[role-name]
AWS Region	The region where both your S3 bucket and SQS queue are located	Both must be in the same region. Example: us-east-1

Note For reference, see the AWS documentation on Amazon S3 Event Notifications (https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html).

Step 1 — Create an IAM Role in AWS

Instead of sharing credentials, this connector uses an IAM role. Bloo assumes this role using your Bloo Tenant ID as a security token — so only your Bloo tenant can access your account. We will create the permissions policy first, then create the role and attach it.

1. Sign in to the AWS Management Console at

   https://console.aws.amazon.com

2. In the search bar, type IAM and select the IAM service.

1. Create the permissions policy first. In the left sidebar, click Policies, then click Create policy. Switch to the JSON tab and paste the following policy. Click Next.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:DeleteMessage",
        "s3:GetObject",
        "sqs:ListQueues",
        "sqs:GetQueueUrl",
        "sqs:ReceiveMessage",
        "s3:ListBucket"
      ],
      "Resource": "*"
    }
  ]
}Copy

Note These are the minimum permissions Bloo needs: s3:GetObject and s3:ListBucket to read log files from S3, and the SQS permissions to receive and delete notifications from the queue.

1. Enter a name for the policy (for example, BlooS3CrossAccountPolicy) and click Create policy.

1. Now create the role. In the left sidebar, click Roles, then click Create role.

1. On the Select trusted entity page, select Another AWS account. In the Account ID field, enter the Bloo AWS Account ID provided to you by your Bloo administrator. Check the Require external ID checkbox and enter your Bloo Tenant ID as the External ID. Then click Next.

Note The External ID is your Bloo Tenant ID. You can find it in the URL of any page after you log in to your Bloo Console. It ensures that only your Bloo tenant can assume this role — no other account can use it even if they know the Role ARN.

1. On the Add permissions page, search for the policy you just created (BlooS3CrossAccountPolicy) and check the box next to it. Click Next.

1. Enter a name for the role (for example, bloo-s3-policy). Skip tags if not needed. Click Create role.

2. Open the role you just created from the Roles list. Copy the Role ARN shown at the top of the role summary page. You will need this to configure Bloo.

Warning Copy the Role ARN now and store it safely. The ARN will be of the following format: arn:aws:iam::[account-id]:role/[role-name]

Step 2 — Create an SQS Queue

Create an SQS queue in the same region as your S3 bucket. Every time a new log file is written to your bucket, S3 will notify this queue and Bloo will pick it up immediately.

1. Open the Amazon SQS console at

   https://console.aws.amazon.com/sqs/

2. Click Create queue. On the Create queue page, select the correct region — it must be the same region as your S3 bucket. The Standard queue type is selected by default. Leave it as Standard — do not change it to FIFO. Enter a name for your queue (for example, bloo-s3-cross-notifications) and click Create queue.

1. Open the queue you just created from the Queues list. Click the Access policy tab, then click Edit.

2. Replace the entire access policy with the following JSON. Update the three values with your own: the SQS queue ARN, your S3 bucket name, and your AWS account ID. Then click Save.

{
  "Version": "2012-10-17",
  "Id": "example-ID",
  "Statement": [{
    "Sid": "example-statement-ID",
    "Effect": "Allow",
    "Principal": { "Service": "s3.amazonaws.com" },
    "Action": [ "SQS:SendMessage" ],
    "Resource": "SQS-queue-ARN",
    "Condition": {
      "ArnLike": { "aws:SourceArn": "arn:aws:s3:*:*:awsexamplebucket1" },
      "StringEquals": { "aws:SourceAccount": "bucket-owner-account-id" }
    }
  }]
}Copy

Note The SQS queue you created is another resource in your AWS account, and it has a unique Amazon Resource Name (ARN). You will need this ARN in the next step. The ARN will be of the following format: arn:aws:sqs:aws-region:account-id:queue-name

1. Copy the Queue URL from the queue details page. You will need this to configure Bloo. It looks like: https://sqs.[region].amazonaws.com/[account-id]/[queue-name].

Step 3 — Configure S3 Event Notifications

Now tell your S3 bucket to send notifications to the SQS queue whenever a new log file is created.

1. Open the Amazon S3 console at

   https://console.aws.amazon.com/s3/

2. Click your bucket name from the list, then click the Properties tab.

3. Scroll down to the Event notifications section and click Create event notification.

4. Fill in the event notification form:

   • Enter a name for the notification (for example, bloo-log-notifications).
   • Under Event types, select All object create events — this triggers a notification every time a new log file is written to the bucket.
   • Under Destination, select SQS queue and choose the queue you created in Step 2.

5. Click Save changes. Amazon S3 sends a test message to your SQS queue to confirm the connection is working.

Step 4 — Configure the Connector in Bloo

With your Role ARN, SQS Queue URL and region ready, set up the connector on the Datasource page in Bloo.

1. In Bloo, navigate to the Datasource page and click Add Datasource.

2. Search for and select AWS S3 Optimized Cross Account.

3. Fill in the configuration fields as described below.

Field	Description	Example
Connector Name	A unique display name for this connector instance in Bloo.	AWSS3Cross-Prod
Role ARN	Enter the Role ARN copied in Step 1.	arn:aws:iam::123456789012:role/BlooS3CrossAccountRole
SQS Queue URL	Enter the Queue URL copied in Step 2.	https://sqs.us-east-1.amazonaws.com/123456789012/bloo-s3-cross-notifications
Region	Enter the AWS region where both your S3 bucket and SQS queue are located.	us-east-1

1. Click Save. The connector proceeds directly to validation.

Confirmed Go to Collection Status (https://dnif.it/kb/operations/collection-status/) in Bloo and verify the AWS S3 Optimized Cross Account connector shows status Active.

Related: How to Configure Connectors Collection Status AWS S3 (Optimized) Connector