This article describes items that need to be set up by the customer before proceeding with other Snowflake- AWS S3 actions.

Step 1: Creating an IAM policy

1. Log into the AWS Management Console.

2. In the Home dashboard, search for and select IAM.

3. From the left-hand navigation pane, select Account settings.

4. Under Security Token Service (STS), in the Endpoints list, find the Snowflake region - US West (N. California). If the STS status is inactive, slide the toggle to Active.

5. From the left-hand navigation pane, click Policies.

6. Select Create Policy.

7. For Policy editor, select JSON.

8. Add a policy document that will allow Snowflake to access the S3 bucket and folder.
   
   The following policy (in JSON format) provides Snowflake with the required permissions to load data using a single bucket and folder path.

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Sid": "VisualEditor0",
   "Effect": "Allow",
   "Action": "s3:ListBucket",
   "Resource": "arn:aws:s3:::"
   },
   {
   "Sid": "VisualEditor1",
   "Effect": "Allow",
   "Action": [
   "s3:PutObject",
   "s3:GetObject"
   ],
   "Resource": "arn:aws:s3:::/*"
   }
   ]
   }

9. Click Next.

10. Enter a Policy name, for example, snowflake_access and optionally, a Description.

11. Click Create policy.

Step 2: Create the IAM Role in AWS

To configure access permissions for Snowflake in the AWS Management Console, do the following:

1. From the left-hand navigation pane in the Identity and Access Management (IAM) dashboard, click Roles.

2. Select Create role.

3. Select AWS account as the trusted entity type.

4. In the Account ID field, enter your own AWS account ID temporarily. Later, you modify the trust relationship and grant access to Snowflake.

5. Select the Require external ID option. An external ID is used to grant access to your AWS resources (such as S3 buckets) to a third party such as Snowflake.
   Enter a placeholder ID such as 0000. In a later step, you will modify the trust relationship for your IAM role and specify the external ID for your storage integration.

6. Select Next.

7. Select the policy you created in Step 1: Creating an IAM policy.

8. Click Next.

9. Enter a name and description for the role, then click Create role.
   You have now created an IAM policy for a bucket, created an IAM role, and attached the policy to the role.

10. On the Role summary page, locate and record the Role ARN value.

NOTE

Once the above steps are complete, share the Role ARN value and bucket name with Level AI. The support team will get back to you with two more details: STORAGE_AWS_IAM_USER_ARN and STORAGE_AWS_EXTERNAL_ID. Once you have received these values, proceed to complete the actions described in Step 3 below.

Step 3: Allowing the Level IAM User to assume the role

The following step-by-step instructions describe how to configure IAM access permissions for Snowflake in your AWS Management Console.

1. Log in to the AWS Management Console and click IAM.

2. From the left-hand navigation pane, click Roles.

3. Select the role you created in Step 2: Create the IAM Role in AWS.

4. Open the Trust relationships tab.

5. Click Edit trust policy.

6. Modify the policy document with the 2 values given to you by Level AI: STORAGE_AWS_IAM_USER_ARN and STORAGE_AWS_EXTERNAL_ID where,
   snowflake_user_arn is the STORAGE_AWS_IAM_USER_ARN value Level AI shared with you. snowflake_external_id is the STORAGE_AWS_EXTERNAL_ID value Level AI shared with you.

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Sid": "",
   "Effect": "Allow",
   "Principal": {
   "AWS": ""
   },
   "Action": "sts:AssumeRole",
   "Condition": {
   "StringEquals": {
   "sts:ExternalId": ""
   }
   }
   }
   ]
   }

Upon receiving your confirmation, we will proceed with configuring the exports on our end. If you have any questions or encounter any issues, please reach out to your Level AI Account Executive/ Point of Contact.