Overview

Funnel's Amazon S3 connector lets you share your Funnel data to an S3 bucket of your choice. This guide will cover what you need to do in your AWS console in order for Funnel to be able to share data there.

Step 1 - Create a bucket

Log in to your AWS S3 Console at http://console.aws.amazon.com/s3/home and create an S3 Bucket. You will need to decide on a globally unique "Bucket name", in our example below this is "funnel-demo". Input the bucket name and select a region from the supported ones below and click "create bucket".

Supported regions

We support all default regions plus some newer Opt-In AWS regions. If your region is not in this list it can be added by reaching out to Funnel support and requesting it.

us-east-2 US East (Ohio)
us-east-1 US East (N. Virginia)
us-west-1 US West (N. California)
us-west-2 US West (Oregon)
ap-south-1 Asia Pacific (Mumbai)
ap-northeast-3 Asia Pacific (Osaka)
ap-northeast-2 Asia Pacific (Seoul)
ap-southeast-1 Asia Pacific (Singapore)
ap-southeast-2 Asia Pacific (Sydney)
ap-northeast-1 Asia Pacific (Tokyo)
ca-central-1 Canada (Central)
eu-central-1 Europe (Frankfurt)
eu-west-1 Europe (Ireland)
eu-west-2 Europe (London)
eu-west-3 Europe (Paris)
eu-north-1 Europe (Stockholm)
sa-east-1 South America (São Paulo)
me-central-1 Middle East (UAE)
me-south-1 Middle East (Bahrain)
af-south-1 Africa (Cape Town)
ap-east-1 Asia Pacific (Hong Kong)
eu-south-1 Europe (Milan)

Step 2 - Set object ownership

To ensure that the uploaded files are owned by you and not by us you have to set that you (as bucket owners) want to be the owner of the files. We always include the bucket-owner-full-control ACL, so that this setting is respected. This setting is found under the bucket permissions tab.

Step 3 - Set bucket permissions

Go to the Permissions tab for your bucket and edit the "Bucket policy".
Review the following, change "funnel-demo" to the name of your bucket (2 places) and then paste it into the policy field.

Note that the s3:DeleteObject permission has been added here. This permission only exists for us to clean up the test files we write to test access before an export. It's also possible not to give us this permission but then you will see one test file per export in your bucket.

If you are using the app.funnel.io service

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FunnelRW",
      "Effect": "Allow",
      "Principal": {"AWS": ["arn:aws:iam::071303700930:role/funnel-export-executor"] },
      "Action": ["s3:PutObject","s3:GetObject","s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::funnel-demo/*"]    
    },
    {
      "Sid": "FunnelList",
      "Effect": "Allow",
      "Principal": {"AWS": ["arn:aws:iam::071303700930:role/funnel-export-executor"]},
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::funnel-demo"]
    }  
  ]
}

If you are using the app.eu.funnel.io service

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FunnelRW",
      "Effect": "Allow",
      "Principal": {"AWS": ["arn:aws:iam::924192298621:role/funnel-s3-uploader-eu"] },
      "Action": ["s3:PutObject","s3:GetObject","s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::funnel-demo/*"]    
    },
    {
      "Sid": "FunnelList",
      "Effect": "Allow",
      "Principal": {"AWS": ["arn:aws:iam::924192298621:role/funnel-s3-uploader-eu"]},
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::funnel-demo"]
    }  
  ]
}

Step 4 - Enable encryption (optional)

If you want to enable encryption on your bucket please also follow this article:
https://help.funnel.io/en/articles/5394170-setting-up-exports-to-encrypted-s3-buckets

All done!

Having completed the two steps above you can now configure your Funnel Share to send data to this S3 bucket. Do this from within your Funnel account.