Add an S3 data source-Lindorm(Lindorm)-阿里云帮助中心

You can add an AWS S3 data source to enable the wide table engine of Lindorm to read data from S3 and export data to S3. To import S3 data into a Lindorm wide table or export Lindorm data to S3, you must first add an S3 data source. This topic describes how to add an S3 data source.

Prerequisites

The LTS service is purchased. For more information, see Purchase and sign in to LTS.
The client IP address is added to the whitelist. For more information, see Configure a whitelist.
The access credentials for AWS S3 are obtained, and the credentials have read and write permissions on the destination bucket.

Authentication methods

When you add an S3 data source, you can use either of the following authentication methods. Select one based on your requirements:

Authentication method	Scenario	Description
Direct AK/SK authentication	Quick validation, or scenarios in which internal audit requirements are not strict.	Uses the AccessKey ID and Secret Access Key of an AWS IAM user for authentication. This method is simple and quick to configure.
IDaaS cross-cloud role authentication	Scenarios that require high security and strict audit compliance.	Uses the trust relationship between Alibaba Cloud Identity as a Service (IDaaS) and AWS IAM to dynamically obtain temporary credentials. This avoids long-term retention of plaintext AccessKey pairs.

Procedure

Log on to the Lindorm console.
In the upper-left corner of the page, select the region where the instance is deployed.
On the Instances page, click the ID of the target instance or click View Instance Details in the Actions column for the instance.
In the left-side navigation pane, click Instance Details. In the UI Access section, click LTS to go to Cluster Management UI.
Important
If this is your first time using LTS, reset the password and add the client IP address to the network whitelist.
In the left-side navigation pane, choose Data Sources > Add Data Source.
On the Add Data Source page, set Data source type to S3.

Configure the following parameters based on the authentication method that you use.

Method 1: Direct AK/SK authentication

In the data source parameter field, enter the following JSON configuration.

{
  "accessId": "your-aws-access-key-id",
  "accessKey": "your-aws-secret-access-key",
  "bucketName": "your-s3-bucket-name",
  "endpoint": "s3.us-west-2.amazonaws.com"
}

Parameter descriptions:

Parameter	Description
accessId	The AccessKey ID of the AWS IAM user.
accessKey	The Secret Access Key of the AWS IAM user.
bucketName	The name of the destination S3 bucket.
endpoint	The S3 service endpoint. Example: `s3.us-west-2.amazonaws.com`. Specify the endpoint that corresponds to the region in which the bucket resides.

Make sure that the AccessKey pair that you provide has read and write permissions on the corresponding bucket, and keep the credentials secure.

Method 2: IDaaS cross-cloud role authentication

Before you use this method, make sure that the following prerequisite is met:

Cross-service unified authorization is complete in the Alibaba Cloud console. For more information, see For AWS accounts.

After the authorization is complete, enter the following JSON configuration in the data source parameter field.

{
  "bucketName": "your-s3-bucket-name",
  "endpoint": "s3.us-west-2.amazonaws.com"
}

Parameter descriptions:

Parameter	Description
bucketName	The name of the destination S3 bucket.
endpoint	The S3 service endpoint. Example: `s3.us-west-2.amazonaws.com`.

IDaaS authentication accesses S3 by using dynamic temporary credentials. There is no risk of long-term static credential leakage, which meets enterprise-grade compliance audit requirements.

Click Add.