S3 Assume Role with Web Identity option missing in DCM

Question

Hi, we are required to use temporary AWS tokens, which require a Session Token alongside the usual key and secret. It seems that Alteryx doesn't support having this third authentication method.

However, the documentation (https://help.alteryx.com/20231/en/designer/data-sources/amazon-s3.html#sign-in-to-amazon-s3) suggests "Assume Role with Web Identity" might work (given that is what I am doing, albeit in a CLI, to get the credentials). But this option is not available to me in DCM. Any ideas?

apathetichell · Answer

are you using MFA? that requires MFA? Alteryx's description makes my head hurts. This explains what get session token means - and when you'd use it --- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html  --- the key part is that you have to have your MFA provider set up. You have users retrieve tokens this way but the MFA provider has to tie into your AWS architecture at a higher role so it can provision identity. It's really an Alteryx/MFA provider integration with AWS along for the ride. I avoid Alteryx Server and DCM so I'm not the expert here. Hypothetically this would go like Alteryx integrates with your MFA. Users have AWS IAM roles which they provision via MFA. DCM hooks the Alteryx server/Designer into your MFA and then into AWS. User auths via MFA --> retrieves temp credentials -> sends token back to Workfow -> runs workflow.  Is that your requirement?

my general suggestions here is spend the time on developing inhouse scripts (ie .bat files) --- have Alteryx connect/work with AWS via CLI. Authenticate to AWS via CLI outside of Alteryx.