External Storage Search Prerequisites

• Configure Amazon S3 external storage for your Salesforce org. See Set Up Amazon S3.
• Set up file access for users. See Set Up File Access in Amazon S3.
• Verify that you have an AWS account with permissions to create IAM roles and policies, S3 buckets, Lambda functions, and resources for Amazon Bedrock or Amazon Kendra.
• Select an AWS Region and use the same region for all related resources, including the S3 bucket, knowledge base or index, and Lambda functions. If you use Amazon Bedrock, confirm that the required models are available in your region. See Model support by AWS Region in the AWS documentation.
• Create or identify the source S3 bucket and block public access to it. For Amazon Bedrock requirements, see Connect to Amazon S3 for your knowledge base in the AWS documentation.
• Verify that the applicable S3 bucket or IAM policy grants permission to write metadata files. If users have read-only access to the bucket, add a policy statement that grants s3:PutObject access only to metadata files.

Sample policy statement:

Replace YOUR-BUCKET-NAME with the name of your S3 bucket.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowWriteToMetadataJsonOnly",
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*metadata.json"
    }
  ]
}