This guide walks you through configuring Amazon S3 as a Sink provider for the purpose of creating an integration with Synqly's Sink connector. Events are written to your S3 bucket as compressed JSON files.
Before you begin, ensure you have:
- An AWS account with access to the AWS Management Console
- An existing S3 bucket (or permission to create one)
- Permission to create IAM users or roles
The Synqly Sink connector writes event files to your S3 bucket. The minimum IAM permission required is:
| Permission | Resource | Purpose |
|---|---|---|
s3:PutObject | arn:aws:s3:::<your-bucket>/* | Write event files to the bucket |
Scope the policy to the specific bucket used for this integration. Avoid granting s3:PutObject on all buckets (*).
Synqly supports two methods for authenticating with AWS: static credentials (IAM user access keys) and role-based access (IAM role assumption). Role-based access is recommended for production environments because it uses short-lived credentials and provides better auditability through CloudTrail.
Role-Based access is recommended and is considered an AWS best practice.
Role-based access uses AWS IAM roles to grant Synqly temporary credentials to access resources in your AWS account. This eliminates long-lived credentials and provides better security through the principle of least privilege.
Create a role in your AWS account with a name that starts with SynqlyAccess (for example, SynqlyAccessS3Reader). This naming convention is required.
- In the AWS IAM console, go to Roles and choose Create role.
- For trusted entity type, choose Custom trust policy.
- Enter the following trust policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::733459310821:role/SynqlyIntegrationAccess"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "YOUR_EXTERNAL_ID"
}
}
}
]
}Replace YOUR_EXTERNAL_ID with a unique identifier you generate (for example, a UUID). You will provide this External ID when configuring the integration.
- Name the role with a
SynqlyAccessprefix (for example,SynqlyAccessMyIntegration). - Attach the appropriate permissions policy for your use case.
- Create the role and note its ARN.
For more details, see:
The External ID is a security mechanism that prevents the confused deputy problem. It ensures that only authorized requests from Synqly can assume your role.
The External ID must contain only the following characters:
- Alphanumeric characters (a-z, A-Z, 0-9)
- Special characters:
+ = , . @ : / - - Must be between 2 and 1224 characters in length
When creating an AWS integration in Synqly, provide the following configuration values based on your chosen authentication method.
| Credential Parameter | Description |
|---|---|
| Role ARN | The ARN of the IAM role you created, for example arn:aws:iam::123456789012:role/SynqlyAccessMyIntegration. The role name must start with SynqlyAccess |
| External ID | The External ID you specified in the role's trust policy. This value must match exactly |
| Role Session Name | OPTIONAL: A name for the role session. If not specified, Synqly generates a default session name |
| Duration | OPTIONAL: The duration of the role session in seconds. The value can range from 900 seconds (15 minutes) up to the maximum session duration configured on your role (default is 1 hour) |
When configuring permissions for either authentication method, attach a policy that grants s3:PutObject on your target bucket (see the Required Permissions section above).
Create your integration by supplying all configuration values.
| Integration Parameter | Description |
|---|---|
| Bucket | The name of the S3 bucket where events will be written. |
| Path | A prefix path for event files. Events are written to {path}/{location}/{YYYY/MM/DD}/{timestamp}.json.gz within the bucket. |
| Region | The AWS region where the S3 bucket is located (for example, us-east-1). |
The Path field controls where event files land inside your bucket. For example, if you set the path to events/sink, files will be written to paths like events/sink/my-location/2026/04/28/2026-04-28T12:00:00.000Z.json.gz. Choose a path that makes it easy to organize and query your event data.