Configuration guide

S3 Assume Role

This method automatically uses the IAM role attached to your EC2 instance to access S3 buckets. No manual credential entry is required.

Before you begin

Availability depends on your school's enabled tools, provider setup, and account permissions. These settings are managed in the web workspace. A class policy may restrict a feature described here.

Prerequisites#

Ensure your EC2 instance has an IAM role attached.
Verify the instance profile is properly configured via AWS Console under EC2 › Instance Settings › Attach/Replace IAM role.

Updating the Existing IAM Role#

Since your EC2 instance already has an IAM role attached, you need to update it with the necessary S3 permissions:

Open role in IAM#

In AWS Console, go to IAM › Roles and find your EC2 instance's existing role.

Attach S3 policy#

Click on the role and go to the Permissions tab. Click Add permissions › Attach policies. Search for and select AmazonS3ReadOnlyAccess policy. Click Attach policies.

Alternatively, for more granular control, you can create a custom inline policy:

Create inline policy#

In the same role's Permissions tab, click Add permissions › Create inline policy. Switch to JSON and add this policy (replace your-source-bucket-name):

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetObject",
          "s3:ListBucket"
        ],
        "Resource": [
          "arn:aws:s3:::your-source-bucket-name",
          "arn:aws:s3:::your-source-bucket-name/*"
        ]
      }
    ]
  }

Name the policy (e.g., NexusS3Access) and click Create policy.

The connector will automatically detect and use the EC2 instance's IAM role for accessing your S3 buckets.

Credential Entry in Nexus#

When configuring the S3 connector in Nexus, you'll need to:

Open Assume Role tab#

Click on the Assume Role tab

No credentials required#

No credentials need to be entered. the connector automatically uses your EC2 instance's attached role.

Once you have updated your EC2 instance's role with S3 permissions, proceed to the indexing steps in the overview to configure your S3 connector.

Before using this source with students#

Start with approved course material. Check which documents the connector can retrieve and how it maps source permissions. Test with a student account and a teacher account before widening access. A successful sync does not prove that the intended class boundary is correct.

Use source troubleshooting when a document is missing or visible to the wrong audience.