Cloud bucket upload is available to [Enterprise plan](https://docs.up42.com/getting-started/account-plans) accounts only. ## Overview Use cloud bucket upload to copy [CNAM-transformed](https://docs.up42.com/data-management/cnam) data items from UP42 storage to your own cloud bucket. We run an upload job on your behalf using cross-cloud identity federation between Google Cloud Platform (GCP) and your bucket. Once configuration and verification are complete, uploads run automatically. Every new data item that appears in your storage is copied to your bucket without any action on your side. Data items that were already in storage before setup aren’t uploaded retroactively. Each upload contains the JSON file of the data item and its associated assets, using a fixed path structure: | Description | Object key | | ------------------ | ------------------------------------------ | | Data item metadata | `up42///item.json` | | Asset file | `up42///` | The `` variable identifies the storage layout version, for example, `v0`. ## Requirements To use cloud bucket upload, ensure the following: - You have an UP42 [Enterprise plan](https://docs.up42.com/getting-started/account-plans) account. - You have an Amazon S3 bucket in your own Amazon Web Services (AWS) account. ## Set up cloud bucket upload Reach out to your UP42 contact to request the cloud bucket upload feature and start the setup process below. Steps are tagged by who typically completes them: Stakeholder A project lead or other decision-maker responsible for planning, approvals, and configuration decisions. SRE A Site Reliability Engineer or Cloud Infrastructure Engineer in your organization. Create an S3 bucket Create an IAM role Request access Apply the trust policy Add S3 permissions Verify integration Find uploaded data Create an S3 bucket in your AWS account. [Go to step](https://docs.up42.com#s3-bucket) Create an IAM role that UP42 will use for upload. [Go to step](https://docs.up42.com#iam-role) Confirm your account and share your bucket and role details with UP42. [Go to step](https://docs.up42.com#access) Apply the trust policy for the dedicated UP42 service account. [Go to step](https://docs.up42.com#iam-trust-policy) Attach S3 permissions to the IAM role. [Go to step](https://docs.up42.com#iam-permissions) Complete configuration and verify the integration. [Go to step](https://docs.up42.com#verification) Find automatically uploaded data in your cloud bucket. [Go to step](https://docs.up42.com#upload) 1 ## Create an S3 bucket SRE 1. In your AWS account, create the bucket in the agreed-upon region. 2. Enable default encryption and block all public access. 3. Confirm the bucket is reachable via public S3 endpoints. 2 ## Create an IAM role SRE In your AWS account, create an IAM role that we’ll use to upload data to your bucket. You’ll configure its trust policy later, after we share the OAuth 2 client ID for your dedicated service account. 3 ## Request access Stakeholder 1. Open the [console](https://console.up42.com/?utm_source=documentation). 2. In the bottom-left corner, click your user icon → **Account management**. 3. To copy your account ID, click Copy. 4. Send the following information to your UP42 contact: - S3 bucket region - S3 bucket name you want to use - IAM role ARN (for example, `arn:aws:iam::123456789012:role/upload-executor`) Once we receive this information from you, we’ll create a GCP service account and share with you the OAuth 2 client ID required for the AWS trust policy. 4 ## Apply the trust policy SRE Update the trust policy on the IAM role you created. Use the OAuth 2 client ID we provided in the following template: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "accounts.google.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "accounts.google.com:sub": "" } } } ] } ``` No separate IAM OIDC provider setup is needed for Google, as AWS already includes `accounts.google.com` as a built-in federated principal. 5 ## Add S3 permissions SRE Attach a policy that grants the upload job the following permissions on `arn:aws:s3:::your-bucket/*`: - `s3:PutObject` - `s3:AbortMultipartUpload` - `s3:DeleteObject` - `s3:ListBucket` (used for verification) - `s3:GetObject` (used for verification) If you use AWS KMS, the IAM role must also include `kms:Decrypt` and `kms:GenerateDataKey` permissions for the relevant key. 6 ## Verify integration SRE We’ll run an end-to-end upload test for a data item in your UP42 account. Once verification succeeds, we’ll confirm that the functionality is ready for you to use. 7 ## Find uploaded data Stakeholder When a new data item is delivered to your storage, the item and its assets will be automatically be uploaded to your bucket under `up42///`. For example, a data item with ID `abc-123` and two assets will appear in your bucket the following way: ```txt your-bucket/ up42/ v0/ abc-123/ item.json 1234-5678 5678-1234 ``` ## Troubleshooting Can I use a custom S3 key prefix? [Can I use a custom S3 key prefix? ](https://docs.up42.com#custom-prefix "Copy link to this section") No. We write objects under the fixed `up42/v0/` prefix. Custom key prefixes aren’t supported. My bucket uses VPC endpoints or IP allowlists. Will upload work? [My bucket uses VPC endpoints or IP allowlists. Will upload work? ](https://docs.up42.com#network-restrictions "Copy link to this section") Our upload job writes to S3 over the public S3 API. Buckets restricted to VPC endpoints, IP allowlists, or private-only access won’t work unless private connectivity is arranged separately. [Contact support](https://up42.com/contact-us/support?utm_source=documentation) to discuss options. Who should configure AWS on our side? [Who should configure AWS on our side? ](https://docs.up42.com#sre "Copy link to this section") Cloud bucket upload requires IAM and S3 configuration in your AWS account. Coordinate with SRE or cloud infrastructure team within your organization.