Cloud bucket upload

1. Open the console.
2. In the bottom-left corner, click your user icon → Account management.
3. To copy your account ID, click .
4. Send the following information to your UP42 contact:
   • S3 bucket region
   • S3 bucket name you want to use

Once we receive this information from you, we’ll create a GCP service account and share with you the OAuth 2 client ID required for the AWS trust policy.

1. In your AWS account, create the bucket in the agreed-upon region.
2. Enable default encryption and block all public access.
3. Confirm the bucket is reachable via public S3 endpoints.

In your AWS account, create a role. Use the GCP account ID we provided in the trust policy in the following template:

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Principal": { "Federated": "accounts.google.com" },
7
      "Action": "sts:AssumeRoleWithWebIdentity",
8
      "Condition": {
9
        "StringEquals": {
10
          "accounts.google.com:sub": "<OAUTH_2_CLIENT_ID>"
11
        }
12
      }
13
    }
14
  ]
15
}

No separate IAM OIDC provider setup is needed for Google, as AWS already includes accounts.google.com as a built-in federated principal.

Attach a policy that grants the upload job the following permissions on arn:aws:s3:::your-bucket/*:

• s3:PutObject
• s3:AbortMultipartUpload
• s3:DeleteObject
• s3:ListBucket (used for verification)
• s3:GetObject (used for verification)

If you use AWS KMS, the IAM role must also include kms:Decrypt and kms:GenerateDataKey permissions for the relevant key.

Provide your IAM role ARN (for example, arn:aws:iam::123456789012:role/upload-executor). We need it so our GCP service account can assume your role as part of the identity federation during upload.

We’ll then run an end-to-end upload test for a data item in your UP42 account. Once verification succeeds, we’ll confirm that the functionality is ready for you to use.

When a new data item is delivered to your storage, the item and its assets will be automatically be uploaded to your bucket under up42/<version>/<data-item-id>/.

For example, a data item with ID abc-123 and two assets will appear in your bucket the following way:

your-bucket/
  up42/
    v0/
      abc-123/
        item.json
        1234-5678
        5678-1234