> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/aws/s3.md).

# S3

## Requirements

| Name           | Description                                                                   |
| -------------- | ----------------------------------------------------------------------------- |
| Teleskope Role | Attach S3 read and/or write permissions to the Teleskope IAM role you created |

***

{% stepper %}
{% step %}

#### Grant Teleskope Read Access to S3

Teleskope needs read access to scan and classify your data stored in S3.

For the standard setup, attach `AmazonS3ReadOnlyAccess` to the Teleskope IAM role you created. This grants read access across the account so Teleskope can discover and scan all buckets.

**Terraform**

```
resource "aws_iam_role_policy_attachment" "s3_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}
```

For SSE-KMS encrypted objects, the role also needs `kms:Decrypt` on the relevant KMS keys, with access allowed by the key policy. `kms:GenerateDataKey` is not required for ordinary object reads. See [AWS SSE-KMS permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html).

Alternatively, create and attach the custom policy below. It includes account-wide reads and tagging permissions:

{% hint style="info" %}
**Optional: narrow permissions.** Replace `arn:aws:s3:::*` and `arn:aws:s3:::*/*` below with the bucket and object ARNs you want to scan. Use the custom policy instead of `AmazonS3ReadOnlyAccess`, without another policy granting broader S3 access. Account-level discovery still lists bucket names across the account, but narrower access reduces scan coverage.

If tagging is not needed, you can remove `s3:PutBucketTagging` and `s3:PutObjectTagging`; tagging actions will then be unavailable.
{% endhint %}

**Terraform**

```
resource "aws_iam_policy" "teleskope_s3_policy" {
  name        = "TeleskopeS3Policy"
  description = "Policy to grant various read permissions for S3 resources."

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "s3:GetBucketPolicyStatus",
          "s3:GetBucketPublicAccessBlock",
          "s3:GetLifecycleConfiguration",
          "s3:GetBucketTagging",
          "s3:GetInventoryConfiguration",
          "s3:GetBucketWebsite",
          "s3:GetBucketLogging",
          "s3:ListBucket",
          "s3:GetBucketVersioning",
          "s3:GetBucketAcl",
          "s3:GetBucketNotification",
          "s3:GetBucketPolicy",
          "s3:GetReplicationConfiguration",
          "s3:GetBucketObjectLockConfiguration",
          "s3:GetEncryptionConfiguration",
          "s3:PutBucketTagging",
          "s3:GetBucketCORS",
          "s3:GetBucketLocation"
        ]
        Resource = "arn:aws:s3:::*"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetObjectAcl",
          "s3:GetObject",
          "s3:GetObjectTagging",
          "s3:PutObjectTagging",
          "s3:GetObjectVersion"
        ]
        Resource = "arn:aws:s3:::*/*"
      },
      {
        Effect = "Allow"
        Action = [
          "s3:GetAccountPublicAccessBlock",
          "s3:ListAllMyBuckets",
          "s3:GetBucketInventoryConfiguration"
        ]
        Resource = "*"
      }
    ]
  })
}
```

{% endstep %}

{% step %}

#### Grant Teleskope Read & Write Access to S3 (Optional)

Grant only the write actions required by the remediation policies you enable, scoped to their target buckets and objects. For example, tagging uses `s3:PutBucketTagging` or `s3:PutObjectTagging`. Scanning does not require these permissions.

`AmazonS3FullAccess` is a broad alternative when full S3 access is approved; it is not required for scanning:

**Terraform**

```
resource "aws_iam_role_policy_attachment" "s3_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
}
```

{% endstep %}
{% endstepper %}

### Inventory Reports (optional)

We highly recommend enabling inventory reports on your buckets. Teleskope could use those reports to efficiently list objects and reduce cost on your cloud.\
When enabling inventory reports, please make sure to add the following fields:

1. Bucket
2. Key
3. Size
4. Last Modified Date
5. Storage Class