AWS S3 Bucket

Overview

The EQTY Governance Platform requires AWS S3 buckets for blob storage.

Required buckets:

Governance artifacts bucket – Stores governance-related documents and artifacts
Integrity store bucket – Stores cryptographic proofs and audit trails

This guide covers:

Creating S3 buckets with proper configuration (CLI or AWS Console)
Setting up IAM users with S3 permissions
Configuring the Helm chart for S3 storage

Prerequisites

AWS account with permissions to create S3 buckets and IAM users
AWS CLI installed and configured (for CLI method)
Two unique bucket names (S3 bucket names must be globally unique)

Helm Configuration

Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.

values.yaml:

governance-service:
  config:
    storageProvider: aws_s3
    awsS3Region: "<aws-region>" # Filled in after step 1
    awsS3BucketName: "<governance-bucket-name>" # Filled in after step 1

integrity-service:
  config:
    integrityAppBlobStoreType: aws_s3
    integrityAppBlobStoreAwsRegion: "<aws-region>" # Filled in after step 1
    integrityAppBlobStoreAwsBucket: "<integrity-bucket-name>" # Filled in after step 1
    integrityAppBlobStoreAwsPrefix: rootstore

secrets.yaml:

global:
  secrets:
    create: true
    storage:
      aws_s3:
        secretName: platform-aws-s3
        values:
          accessKeyId: "<access-key-id>" # Filled in after step 5
          secretAccessKey: "<secret-access-key>" # Filled in after step 5

Quick Start (CLI Method - Recommended)

1. Create S3 Buckets

Choose an AWS region for the buckets (e.g. us-east-1, eu-west-1). All bucket commands and Helm values should use the same region.

Create the governance artifacts and integrity store buckets. Replace <governance-bucket-name> and <integrity-bucket-name> with globally unique names, and us-east-1 with the chosen region:

aws s3 mb s3://<governance-bucket-name> --region us-east-1
aws s3 mb s3://<integrity-bucket-name> --region us-east-1

Update values.yaml with the bucket names and region.

values.yaml -> governance-service.config:

awsS3Region: "<region>"
awsS3BucketName: "<governance-bucket-name>"

values.yaml -> integrity-service.config:

integrityAppBlobStoreAwsRegion: "<region>"
integrityAppBlobStoreAwsBucket: "<integrity-bucket-name>"

Optionally enable versioning on each bucket for data protection:

aws s3api put-bucket-versioning \
  --bucket <governance-bucket-name> \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-versioning \
  --bucket <integrity-bucket-name> \
  --versioning-configuration Status=Enabled

2. Create IAM Policy

Create a policy document file named s3-policy.json with the following content, filling in the bucket names from step 1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::<governance-bucket-name>",
        "arn:aws:s3:::<governance-bucket-name>/*",
        "arn:aws:s3:::<integrity-bucket-name>",
        "arn:aws:s3:::<integrity-bucket-name>/*"
      ]
    }
  ]
}

Create the IAM policy:

aws iam create-policy \
  --policy-name governance-s3-access \
  --policy-document file://s3-policy.json \
  --description "Allow EQTY Governance Platform to access S3 buckets"

Save the policy ARN from the output — it will look like arn:aws:iam::123456789012:policy/governance-s3-access.

3. Create IAM User

aws iam create-user --user-name governance-platform

4. Attach Policy to User

To find the AWS account ID:

aws sts get-caller-identity --query Account --output text

Attach the policy. Replace ACCOUNT_ID with the value from above:

aws iam attach-user-policy \
  --user-name governance-platform \
  --policy-arn arn:aws:iam::ACCOUNT_ID:policy/governance-s3-access

5. Create Access Key

aws iam create-access-key --user-name governance-platform

Save both the AccessKeyId and SecretAccessKey from the output. The secret access key is only shown once and cannot be retrieved later.

The output will look like:

{
  "AccessKey": {
    "UserName": "governance-platform",
    "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "Status": "Active"
  }
}

Update secrets.yaml with the credentials.

secrets.yaml -> global.secrets.storage.aws_s3.values:

accessKeyId: "<access-key-id>"
secretAccessKey: "<secret-access-key>"

Alternative: Web UI Setup

Click to expand AWS Console instructions

Using the AWS Console

1. Create S3 Buckets

Navigate to S3 console
Create two buckets: one for governance artifacts and another for the integrity store
Note the bucket names and region

Update values.yaml with the bucket names and region.

values.yaml -> governance-service.config:

awsS3Region: "<region>"
awsS3BucketName: "<governance-bucket-name>"

values.yaml -> integrity-service.config:

integrityAppBlobStoreAwsRegion: "<region>"
integrityAppBlobStoreAwsBucket: "<integrity-bucket-name>"

2. Create IAM User

Navigate to IAM console
Create a new IAM user
Select “Attach policies directly”

3. Create IAM Policy

Select “Create Policy”
Under “Actions Allowed”, select “All S3 actions (s3:*)”
Under “Resources”, select “Specific”
In the “bucket” section, add the ARN for both buckets
In the “object” section, add the bucket ARNs and check “Any object name” for both

4. Attach Policy and Create Access Key

Create the policy and attach it to the IAM user
Select the created IAM user, navigate to “Security Credentials” and create an access key
Save the Access Key ID and Secret Access Key

Update secrets.yaml with the credentials.

secrets.yaml -> global.secrets.storage.aws_s3.values:

accessKeyId: "<access-key-id>"
secretAccessKey: "<secret-access-key>"

Verification

Test that the IAM user can access the buckets. Set the credentials from step 5:

export AWS_ACCESS_KEY_ID=<access-key-id>
export AWS_SECRET_ACCESS_KEY=<secret-access-key>

List objects in the governance artifacts bucket (should be empty initially):

aws s3 ls s3://<governance-bucket-name> --region <region>

List objects in the integrity store bucket:

aws s3 ls s3://<integrity-bucket-name> --region <region>

Clean up the temporary credentials:

unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY

If the commands succeed without errors, the configuration is correct.

Security Best Practices

Least Privilege: The IAM policy restricts s3:* to specific bucket ARNs — avoid broadening to account-wide permissions
Access Key Rotation: Regularly rotate IAM access keys and update Kubernetes secrets
Block Public Access: S3 blocks public access by default for new buckets — ensure this is not disabled
Enable Versioning: Enable object versioning to protect against accidental deletion
Audit Logging: Enable S3 server access logging or CloudTrail for access monitoring

AWS S3 Bucket

Overview

Prerequisites

Helm Configuration

Quick Start (CLI Method - Recommended)

1. Create S3 Buckets

2. Create IAM Policy

3. Create IAM User

4. Attach Policy to User

5. Create Access Key

Alternative: Web UI Setup

Using the AWS Console

1. Create S3 Buckets

2. Create IAM User

3. Create IAM Policy

4. Attach Policy and Create Access Key

Verification

Security Best Practices

Official Documentation