> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Ops Authing from AWS

> Configure delegated ops authorization for AutoMQ cloud service on AWS S3 with detailed steps and policies. Enjoy cloud-native scalability and Kafka compatibility.

Refer to [Manage Environment Ops Authing▸](/automq-cloud/manage-environments/manage-environment-ops-authing/overview), when using the AutoMQ Cloud BYOC product, the AutoMQ service provider needs the user to provide the appropriate ops authorization. This document explains how to configure delegated ops authorization in AWS S3.

> [!TIP]
>
> When installing the AutoMQ console in an AWS environment, operational authorization is usually completed automatically by default.
>
> * **If your version is >= 8.0**: manual authorization is usually not required.
> * **If your version is \< 8.0**: manual authorization must be performed according to the guidelines in this document.

### AWS Environment Authorization

The AWS S3 console provides the Bucket Policy authorization feature. The operation steps are referenced in the document below.

#### Console Operation Steps

Log in to the cloud account that owns the Ops Bucket or a sub-account with authorization capabilities, and go to the [S3 Console](https://ap-southeast-1.console.aws.amazon.com/s3/buckets?region=ap-southeast-1):

1. **Go to the Bucket list page and find the target Bucket.** The user visits the S3 console, clicks on **Bucket List** on the left navigation bar, and enters the list page. Search for the Ops Bucket configured for the current environment and click on the details.

![](https://mintcdn.com/automq/Nkuel_v7FAcWxmbN/automq-cloud/manage-environments/manage-environment-ops-authing/set-ops-authing-from-aws/1.webp?fit=max\&auto=format\&n=Nkuel_v7FAcWxmbN\&q=85\&s=8b264fe7af24fdc13ff51034313fc3f9)

2. **Go to the Permissions menu and find the Bucket Policy.** Click **Edit** to open the authorization form.

![](https://mintcdn.com/automq/HveFFwfWarPtnDnE/automq-cloud/manage-environments/manage-environment-ops-authing/set-ops-authing-from-aws/2.webp?fit=max\&auto=format\&n=HveFFwfWarPtnDnE\&q=85\&s=3cac7314b2d32ce64e3ec2cdb310d165)

3. **Fill in Authorization Information and Create a Bucket Authorization Policy.** Follow the instructions below to fill in the necessary authorization information, click OK, and complete the creation of the authorization policy.

   * Authorized Resource: Select the specified Ops Bucket.

   * Authorized User: Refer to [Overview▸](/automq-cloud/manage-environments/manage-environment-ops-authing/overview), and fill in the AutoMQ service provider cloud account ID "381492316447".

   * Authorized Operation: Refer to the policy below.

```json theme={null}
{
        "Version": "2012-10-17",
        "Statement": [
                {
                        "Effect": "Allow",
                        "Principal": {
                                "AWS": "arn:aws:iam::381492316447:root"
                        },
                        "Action": [
                                "s3:GetObject",
                                "s3:GetObjectVersion",
                                "s3:GetObjectAcl",
                                "s3:GetObjectTagging",
                                "s3:GetObjectVersionAcl",
                                "s3:GetObjectVersionTagging",
                                "s3:ListBucket",
                                "s3:ListBucketVersions",
                                "s3:ListBucketMultipartUploads",
                                "s3:PutObject"
                        ],
                        "Resource": [
                                "arn:aws:s3:::{Ops Bucket Name}",
                                "arn:aws:s3:::{Ops Bucket Name}/*"
                        ]
                }
        ]
}
```

![](https://mintcdn.com/automq/HveFFwfWarPtnDnE/automq-cloud/manage-environments/manage-environment-ops-authing/set-ops-authing-from-aws/3.webp?fit=max\&auto=format\&n=HveFFwfWarPtnDnE\&q=85\&s=b6e2c9d23292f4c3a0afe61da2810dc4)

#### Optional: restrict access to cluster configuration

Logs stored in the AutoMQ Ops Bucket also include cluster configuration information. To prevent AutoMQ from accessing configuration objects under `automq/config/` and `automq/config-template/`, use the policy below.

This policy keeps read and list access for the Ops Bucket, limits `s3:PutObject` to `automq/metadata/` and `automq/license/`, and adds an explicit `Deny` for reads from the two configuration prefixes. Replace every occurrence of `{Ops Bucket Name}` with your environment's Ops Bucket name. Use the statements below in place of the original AutoMQ Allow statement. Remove any existing broader `s3:PutObject` Allow. Retain unrelated Bucket Policy statements.

```json theme={null}
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::381492316447:root"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetObjectAcl",
                "s3:GetObjectTagging",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::{Ops Bucket Name}",
                "arn:aws:s3:::{Ops Bucket Name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::381492316447:root"
            },
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::{Ops Bucket Name}/automq/metadata/*",
                "arn:aws:s3:::{Ops Bucket Name}/automq/license/*"
            ]
        },
        {
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::381492316447:root"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetObjectAcl",
                "s3:GetObjectTagging",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging"
            ],
            "Resource": [
                "arn:aws:s3:::{Ops Bucket Name}/automq/config/*",
                "arn:aws:s3:::{Ops Bucket Name}/automq/config-template/*"
            ]
        }
    ]
}
```

Bucket listing permissions remain unchanged, so object names under the configuration prefixes may still appear in listing results. The `s3:PutObject` permission applies only to objects under `automq/metadata/` and `automq/license/`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.