ScowttCentro de ayuda

Este artículo solo está disponible en inglés.

Para Data owners · Actualizado el 6 nov 2026

Share data through Amazon S3

You keep full ownership of your S3 bucket. Your team writes scheduled exports to it, and creates a role in your own AWS account that gives Scowtt read-only access to a specific bucket or folder. No access keys or long-lived credentials are ever shared, and you can revoke access entirely on your end at any time by deleting the role.

How it works: Scowtt sends you its role details and a unique External ID. You create a read-only role for one bucket or folder and send Scowtt the role details. Scowtt checks the data with you.

Before you start

  • Someone who can create IAM roles and policies in your AWS account.
  • From Scowtt: Scowtt's AWS role ARN and a unique External ID for your account. Your Scowtt team sends these with the policy templates below.

Steps

  1. Scowtt: Send your role details and External ID

    Your Scowtt team creates a unique External ID for your integration and sends it with Scowtt's role ARN and the policy templates below.

  2. You: Create an IAM role with this trust policy

    Choose a dedicated bucket, or a folder (prefix) in an existing bucket, for example s3://yourcompany-data/scowtt/. Then create the role, using the role ARN and External ID Scowtt sent:

    {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "<SCOWTT_ROLE_ARN>" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "<YOUR_EXTERNAL_ID>" } }
  }]
}

    AWS's step-by-step guide: Create a role using custom trust policies.

  3. You: Attach a read-only permissions policy

    Scope it to your bucket and folder:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::<BUCKET>",
      "Condition": { "StringLike": { "s3:prefix": ["<PREFIX>/*", "<PREFIX>"] } }
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:GetObjectAttributes"],
      "Resource": "arn:aws:s3:::<BUCKET>/<PREFIX>/*"
    }
  ]
}

  4. You: Organize your files

    Use one folder per table, partitioned by date and hour, for example s3://yourcompany-data/scowtt/appointments/dt=2026-10-30/hour=13/part-00000.parquet.

  5. You: Send Scowtt your role details

    Send your Scowtt team the new role ARN, the exact bucket and folder path, and the AWS region.

  6. You: Load the historical backfill

    Load the full history into the folder first, and tell your Scowtt team when it's there.

  7. Scowtt: Check the data with you

    Scowtt validates access and the backfill with you. Then you turn on recurring exports, ideally hourly, and Scowtt turns on recurring reads.

Good to know

  • Check the exact path. Before Scowtt starts, list the folder yourself and confirm files are where you said. Exports often land one folder deeper than expected.
  • Encrypted with your own KMS key? Add kms:Decrypt for that key to the role's policy, and allow the role in the key policy. Default S3 encryption needs no change.
  • Files written by another AWS account or a vendor may be unreadable to Scowtt unless the bucket's Object Ownership is set to Bucket owner enforced, the default for new buckets.
  • Bucket policies that deny access from outside your network, for example by VPC endpoint or IP address, also block Scowtt. Add an exception for the Scowtt role.
  • Follow the data format standards for formats, folders and file names.

Who does what

StepWhoWhat changes hands
Send your role details and External IDScowttRole ARN, External ID, policy templates
Create an IAM role with this trust policyYou—
Attach a read-only permissions policyYou—
Organize your filesYou—
Send Scowtt your role detailsYouYour role ARN, bucket and folder path, AWS region
Load the historical backfillYouHistory files
Check the data with youScowttConfirmation, or fixes needed
Data format standardsFor file-based delivery through S3, GCS or SFTP, exports should follow these standards.Share data through Google Cloud StorageFor teams already on Google Cloud, Scowtt can set up a read-only access pattern against a GCS bucket you own, similar to the S3 setup.Choose how to connect your dataThere are several ways to share CRM and analytics data with Scowtt. Your Scowtt team will help you pick the one that fits your environment best.