Skip to content
Docs

AWS S3

Exchange files with Figure through an S3 bucket that you host or that Figure hosts.

View as Markdown
On this page· 7 sections

Partner-hosted S3 bucket#

Use this when Figure delivers files to you, such as Data Export files.

You provide an S3 bucket. Figure writes objects using short-lived AWS credentials coordinated during onboarding.

For partner-hosted S3, cross-account IAM role assumption is the recommended path: you create a delivery role in your account; Figure assumes that role to upload files. Long-lived IAM user access keys remain supported when role assumption is not an option.

Prefer GCS when you can

If your organization can host a GCS bucket, that path uses IAM grants instead of AWS keys or cross-account roles. See Partner-hosted GCS bucket.

How Figure authenticates to your S3#

  • Figure file delivery runs on Google Cloud. Figure does not run compute inside your AWS account.
  • On the IAM role path, Figure does not use long-lived access keys. Figure obtains short-lived credentials, then calls sts:AssumeRole into your delivery role to call S3.
  • Your role trust policy must allow a Figure IAM role ARN (Role A) that Figure provides during onboarding. Trust the role ARN (arn:aws:iam::…:role/…), not an assumed-role/…/session form from STS.

You create an IAM role in your AWS account (Role B) that Figure assumes to write to your bucket or prefix.

Figure IAM roles to trust (Role A) — Figure provides separate IAM role ARNs for test and production during onboarding over a secure channel (not email or tickets). Use the test principal for non-production integrations and the production principal for live delivery. The ARN shape is:

arn:aws:iam::<figure-aws-account-id>:role/<figure-file-transfer-role>

What Figure needs from you

  • Bucket name and AWS Region
  • Optional prefix / directory
  • The ARN of your delivery role (Role B)
  • An ExternalId your organization generates, if your trust policy requires it (Figure stores and sends it on every AssumeRole; coordinate through a secure channel — not email or tickets)
  • Separate test and production buckets and roles where applicable
  • Confirmation that the file-exchange IP addresses are allowlisted if you restrict by source IP

What you configure in AWS (Role B)

  • Trust policy: allow sts:AssumeRole from the Figure Role A ARN for that environment; use an sts:ExternalId condition when required
  • Permissions: least privilege on the bucket or prefix — typically s3:PutObject, s3:ListBucket (scoped to the prefix), and s3:DeleteObject only if needed
  • Bucket must not be public. If the bucket uses default encryption (for example SSE-KMS), align expectations during onboarding

Example trust policy statement — substitute the Principal and ExternalId with the values Figure and your organization exchange during onboarding:

JSON
{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::<figure-aws-account-id>:role/<figure-file-transfer-role>"
  },
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringEquals": {
      "sts:ExternalId": "<partner-issued-external-id>"
    }
  }
}

Use the production Role A ARN in production trust policies and the test Role A ARN in non-production trust policies.

Static IAM user or access keys (alternate)

Figure can write using an IAM user or access keys scoped to your bucket, exchanged through a secure channel — not email or tickets.

What Figure needs from you

  • Bucket name
  • Optional prefix / directory
  • AWS access credentials for that bucket (or a scoped IAM user that can write to it)

Least-privilege on the bucket or prefix is preferred (s3:PutObject, s3:GetObject, s3:ListBucket, and s3:DeleteObject as needed).

Figure-hosted S3 bucket#

Use this when you deliver files to Figure.

Figure provides an S3 bucket. You access it with an IAM role or credentials that you provide.

For more information about how to upload and download with S3 buckets, see the linked AWS documentation.

What Figure needs from you#

  • The full ARN of your AWS role, or the credentials you will use to access the bucket

What you will need from Figure#

  • The name of the S3 bucket

Common questions#