Brief Overview

Integrate with AWS S3 to securely transfer data for analytics, Insights backups, or automated workflows. Follow the steps in this article to connect your AWS S3 storage connection.

How It Works

AWS S3 connections page overview

The AWS S3 Connections page is a central hub for viewing and managing all of your configured S3 connections.

1. AWS S3 table

The AWS S3 connections table lists all configured connections.

Table columns:

1. Connection ID: Unique identifier for the connection

2. Connection name: Custom name given to the connection

3. Authentication method: Type of authentication used

4. Bucket name: Name of the S3 bucket connected

5. Bucket path: Folder path within the bucket (if defined)

6. Region: AWS region where the bucket is hosted

7. Created by: User who created the connection

8. Last modified by: User who last updated the connection

2. Table icons

Manage columns

Remove or add columns from the table

1. Click the Manage columns icon

2. Select which columns you'd like to have in the table

3. Click Apply

Add new connection

1. Click the + Add New Connection button to add a new AWS S3 connection

Export connections

1. Click the Export Connections icon to download a csv or xlsx file containing all configured connection details

Search

Use the Search bar to quickly find specific connections

Item options

Available actions:

1. Click the Edit icon to update the connection

2. Click the Delete icon to remove the connection

How to setup an AWS S3 connection

You can add a new connection whether it's your first or you're adding to existing ones.

1. Choose how to start:

   1. If this is your first connection:

      1. Go to the Available connections tab

      2. Hover over the AWS S3 tile

      3. Click Setup

   2. If you already have connections:

      1. Go to the Active connections tab

      2. Hover over the AWS S3 tile

      3. Click Manage Connections

      4. A table will open showing all configured connections for that integration

      5. Click Add new connection

2. You'll be taken to the Add AWS S3 Connection page

3. Give your connection a clear, descriptive name so you can easily recognize it later

   1. For example: MarketingReports_S3_EU

4. Select an authentication method from the dropdown that matches your security and access setup:

   a. Bucket settings:
   Step 1 - Configure AWS S3 (Customer side)

   1. Login to you AWS S3 Console and select the target bucket

   2. Create a folder: Inside the bucket, create a folder and name it "walkme" to define the path WalkMe will access (optional)

   3. Go to the Permissions tab and scroll down to Bucket Policy

   4. Click Edit and paste the following JSON policy:

      "Version": "2012-10-17",
      
      "Id": "WalkMeS3AccessPolicy",
      
      "Statement": [
      
      {
      
      "Sid": "AllowWalkMeList",
      
      "Effect": "Allow",
      
      "Principal": {
      
      "AWS": "REPLACE_WITH_CORRECT_ARN_FROM_LIST"
      
      },
      
      "Action": ["s3:ListBucket"],
      
      "Resource": "arn:aws:s3:::your-bucket-name"
      
      },
      
      {
      
      "Sid": "AllowWalkMeReadWrite",
      
      "Effect": "Allow",
      
      "Principal": {
      
      "AWS": "REPLACE_WITH_CORRECT_ARN_FROM_LIST"
      
      },
      
      "Action": [
      
      "s3:PutObject",
      
      "s3:GetObject",
      
      "s3:DeleteObject"
      
      ],
      
      "Resource": "arn:aws:s3:::your-bucket-name/*"
      
      }
      
      ]
      
      }

Step 2 - Connect in WalkMe Console

1. 1. Enter a clear descriptive Connection Name
   2. Select Bucket settings as the Authentication Method
   3. Enter the exact Bucket Name of your S3 bucket
   4. Enter the name of the folder created in Phase 1 (e.g., walkme) in Bucket Path field
   5. Select the Region where your bucket is hosted
   6. Select Test Connection to validate and test access to the bucket path

b. IAM Role - Bucket on customer's side:

Step 1- Configure AWS S3 (Customer side)

1. In the AWS Console, create a new IAM role
2. Add Permissions Policy: Attach a policy to the role with the following JSON:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowWalkMeList",
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::<bucket-name>"
},
{
"Sid": "AllowWalkMeReadWrite",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::<bucket-name>/*"
}
]
}

3. In the Trust Relationships tab of the role, select Edit trust policy and paste the JSON:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "REPLACE_WITH_YOUR_ENVIRONMENT_ARN"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}

Step 2 - Connect in WalkMe Console

1. Enter a clear descriptive Connection Name
2. Select IAM Role - Bucket on customer's side as the Authentication Method
3. Enter the exact Bucket Name of your S3 bucket
4. Enter the name of the folder created in Phase 1 (e.g., walkme) in Bucket Path field (optional)
5. Enter the ARN of the role you created in the AWS console ( for example, arn:aws:iam::[Your_Account_ID]:role/[Role_Name])
6. Select the Region where your bucket is hosted

ARN information per data center

• US/SAP US00: arn:aws:iam::584278441476:role/walkme-s3-integrations-prod
• EU / SAP EU00: arn:aws:iam::584278441476:role/walkme-s3-integrations-eu-prod
• SAP US: arn:aws:iam::116981778579:role/walkme-s3-integrations-us01
• SAP EU: arn:aws:iam::116981778579:role/walkme-s3-integrations-eu01
• FedRamp: arn:aws:iam::98239675038:role/walkme-s3-integrations-gov-t01
• Canada: arn:aws:iam::842147824859:role/walkme-s3-integrations-prod2

Access key & secret key:

1. Access & secret key

   As of Feb 22, 2026 this method is no longer supported for new connections. Existing connections will continue to be supported however a warning will display encouraging users to migrate to more secure methods

For existing connections:

• S3 bucket name: The name of the connected S3 bucket
• Optional folder path: A folder or sub-folder within the bucket
• AWS access key: Identifies the AWS user making the request
• AWS secret key: Authenticates the request and works with the access key to securely sign it
• Region: The AWS region where the bucket is hosted4. Click Test Connection to validate that your connection works

• • If the test is successful, you'll see a confirmation message

  • If there's an issue, you'll get an error message with steps to fix it

          5. Click Save