AWS S3 Bucket
Overview
Section titled “Overview”The EQTY Governance Platform requires AWS S3 buckets for blob storage.
Required buckets:
- Governance artifacts bucket – Stores governance-related documents and artifacts
- Integrity store bucket – Stores cryptographic proofs and audit trails
This guide covers:
- Creating S3 buckets with proper configuration (CLI or AWS Console)
- Setting up IAM users with S3 permissions
- Configuring the Helm chart for S3 storage
Prerequisites
Section titled “Prerequisites”- AWS account with permissions to create S3 buckets and IAM users
- AWS CLI installed and configured (for CLI method)
- Two unique bucket names (S3 bucket names must be globally unique)
Helm Configuration
Section titled “Helm Configuration”Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.
values.yaml:
governance-service
:
config
:
storageProvider
:
aws_s3
awsS3Region
:
"
secrets.yaml:
global
:
secrets
:
create
:
true
storage
:
aws_s3
:
secretName
:
platform-aws-s3
values
:
accessKeyId
:
"
Quick Start (CLI Method - Recommended)
Section titled “Quick Start (CLI Method - Recommended)”1. Create S3 Buckets
Section titled “1. Create S3 Buckets”Choose an AWS region for the buckets (e.g. us-east-1, eu-west-1). All bucket commands and Helm values should use the same region.
Create the governance artifacts and integrity store buckets. Replace
and
with globally unique names, and us-east-1 with the chosen region:
aws
s3
mb
s3://
Update values.yaml with the bucket names and region.
values.yaml -> governance-service.config:
awsS3Region
:
"
values.yaml -> integrity-service.config:
integrityAppBlobStoreAwsRegion
:
"
Optionally enable versioning on each bucket for data protection:
aws
s3api
put-bucket-versioning
\
--bucket
aws
s3api
put-bucket-versioning
\
--bucket
2. Create IAM Policy
Section titled “2. Create IAM Policy”Create a policy document file named s3-policy.json with the following content, filling in the bucket names from step 1:
{
"Version"
:
"
2012-10-17
"
,
"Statement"
: [
{
"Effect"
:
"
Allow
"
,
"Action"
:
"
s3:*
"
,
"Resource"
: [
"
arn:aws:s3:::
/*
"
,
"
arn:aws:s3:::
/*
"
]
}
]
}
Create the IAM policy:
aws
iam
create-policy
\
--policy-name
governance-s3-access
\
--policy-document
file://s3-policy.json
\
--description
"
Allow EQTY Governance Platform to access S3 buckets
"
Save the policy ARN from the output — it will look like arn:aws:iam::123456789012:policy/governance-s3-access.
3. Create IAM User
Section titled “3. Create IAM User”
aws
iam
create-user
--user-name
governance-platform
4. Attach Policy to User
Section titled “4. Attach Policy to User”To find the AWS account ID:
aws
sts
get-caller-identity
--query
Account
--output
text
Attach the policy. Replace ACCOUNT_ID with the value from above:
aws
iam
attach-user-policy
\
--user-name
governance-platform
\
--policy-arn
arn:aws:iam::ACCOUNT_ID:policy/governance-s3-access
5. Create Access Key
Section titled “5. Create Access Key”
aws
iam
create-access-key
--user-name
governance-platform
Save both the AccessKeyId and SecretAccessKey from the output. The secret access key is only shown once and cannot be retrieved later.
The output will look like:
{
"AccessKey"
: {
"UserName"
:
"
governance-platform
"
,
"AccessKeyId"
:
"
AKIAIOSFODNN7EXAMPLE
"
,
"SecretAccessKey"
:
"
wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
"
,
"Status"
:
"
Active
"
}
}
Update secrets.yaml with the credentials.
secrets.yaml -> global.secrets.storage.aws_s3.values:
accessKeyId
:
"
Alternative: Web UI Setup
Section titled “Alternative: Web UI Setup”Click to expand AWS Console instructions
Using the AWS Console
Section titled “Using the AWS Console”1. Create S3 Buckets
Section titled “1. Create S3 Buckets”- Navigate to S3 console
- Create two buckets: one for governance artifacts and another for the integrity store
- Note the bucket names and region
Update values.yaml with the bucket names and region.
values.yaml -> governance-service.config:
awsS3Region
:
"
values.yaml -> integrity-service.config:
integrityAppBlobStoreAwsRegion
:
"
2. Create IAM User
Section titled “2. Create IAM User”- Navigate to IAM console
- Create a new IAM user
- Select “Attach policies directly”
3. Create IAM Policy
Section titled “3. Create IAM Policy”- Select “Create Policy”
- Under “Actions Allowed”, select “All S3 actions (s3:*)”
- Under “Resources”, select “Specific”
- In the “bucket” section, add the ARN for both buckets
- In the “object” section, add the bucket ARNs and check “Any object name” for both
4. Attach Policy and Create Access Key
Section titled “4. Attach Policy and Create Access Key”- Create the policy and attach it to the IAM user
- Select the created IAM user, navigate to “Security Credentials” and create an access key
- Save the Access Key ID and Secret Access Key
Update secrets.yaml with the credentials.
secrets.yaml -> global.secrets.storage.aws_s3.values:
accessKeyId
:
"
Verification
Section titled “Verification”Test that the IAM user can access the buckets. Set the credentials from step 5:
export
AWS_ACCESS_KEY_ID
=
List objects in the governance artifacts bucket (should be empty initially):
aws
s3
ls
s3://
List objects in the integrity store bucket:
aws
s3
ls
s3://
Clean up the temporary credentials:
unset
AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
If the commands succeed without errors, the configuration is correct.
Security Best Practices
Section titled “Security Best Practices”- Least Privilege: The IAM policy restricts
s3:*to specific bucket ARNs — avoid broadening to account-wide permissions - Access Key Rotation: Regularly rotate IAM access keys and update Kubernetes secrets
- Block Public Access: S3 blocks public access by default for new buckets — ensure this is not disabled
- Enable Versioning: Enable object versioning to protect against accidental deletion
- Audit Logging: Enable S3 server access logging or CloudTrail for access monitoring