S3

• An AWS account. Create an AWS account.
• An S3 bucket. Create an S3 bucket. Additional approaches are in the following video and in the how-to sections at the end of this page.
• Anonymous (supported but not recommended) or authenticated access to the bucket.
  • Enable anonymous bucket access.
  • Enable authenticated bucket access.
• For authenticated bucket read access, the authenticated AWS IAM user must have at minimum the permissions of s3:ListBucket and s3:GetObject for that bucket. Learn how.
• For bucket write access, authenticated access to the bucket must be enabled (anonymous access must not be enabled), and the authenticated AWS IAM user must have at minimum the permission of s3:PutObject for that bucket. Learn how.
• For authenticated access, an AWS access key and secret access key for the authenticated AWS IAM user in the account. Create an AWS access key and secret access key.
• For authenticated access in untrusted environments or enhanced security scenarios, an AWS STS session token for temporary access, in addition to an AWS access key and secret access key. Create a session token.
  AWS STS credentials can be valid for as little as 15 minutes or as long as 36 hours, depending on how the credentials were initially generated. After the expiry time, the credentials are no longer valid will no longer work with the corresponding S3 connector. You must get a new set of credentials to replace the expired ones by calling GetSessionToken in the AWS STS API. To overwrite the expired credentials with the new set:

  • For the Unstructured user interface (UI), manually update the AWS Key, AWS Secret Key, and STS Token fields in the Unstructured UI for the corresponding S3 source or destination connector.
  • For the Unstructured API, use the Unstructured Workflow Endpoint to call the update source or update destination connector operation for the corresponding S3 source or destination connector.
  • For Unstructured Ingest, change the values of --key, --secret, and --token (CLI) or key, secret, and token (Python) in your command or code for the corresponding S3 source or destination connector.
• If the target files are in the root of the bucket, the path to the bucket, formatted as protocol://bucket/ (for example, s3://my-bucket/). If the target files are in a folder, the path to the target folder in the S3 bucket, formatted as protocol://bucket/path/to/folder/ (for example, s3://my-bucket/my-folder/).
• If the target files are in a folder, and authenticated bucket access is enabled, make sure the authenticated AWS IAM user has authenticated access to the folder as well. Enable authenticated folder access.

pip install "unstructured-ingest[s3]"

• AWS_S3_URL - The path to the S3 bucket or folder, formatted as s3://my-bucket/ (if the files are in the bucket’s root) or s3://my-bucket/my-folder/.
• If the bucket does not have anonymous access enabled, provide the AWS credentials:
  • AWS_ACCESS_KEY_ID - The AWS access key ID for the authenticated AWS IAM user, represented by --key (CLI) or key (Python).
  • AWS_SECRET_ACCESS_KEY - The corresponding AWS secret access key, represented by --secret (CLI) or secret (Python).
  • AWS_STS_TOKEN - If required, the AWS STS session token for temporary access, represented by --token (CLI) or token (Python).
• If the bucket has anonymous access enabled for reading from the bucket, set --anonymous (CLI) or anonymous=True (Python) instead.

#!/usr/bin/env bash

# Chunking and embedding are optional.

unstructured-ingest \
  s3 \
    --remote-url $AWS_S3_URL \
    --download-dir $LOCAL_FILE_DOWNLOAD_DIR \
    --key $AWS_ACCESS_KEY_ID \
    --secret $AWS_SECRET_ACCESS_KEY \
    --token $AWS_STS_TOKEN \ # If using AWS STS token.
    --partition-by-api \
    --api-key $UNSTRUCTURED_API_KEY \
    --partition-endpoint $UNSTRUCTURED_API_URL \
    --strategy fast \
    --chunking-strategy by_title \
    --embedding-provider huggingface \
    --strategy hi_res \
    --additional-partition-args="{\"split_pdf_page\":\"true\", \"split_pdf_allow_failed\":\"true\", \"split_pdf_concurrency_level\": 15}" \
  local \
    --output-dir $LOCAL_FILE_OUTPUT_DIR

• To do local file processing, omit --partition-by-api (CLI) or partition_by_api (Python), or explicitly specify partition_by_api=False (Python). Local file processing does not use an Unstructured API key or API URL, so you can also omit the following, if they appear:
  • --api-key $UNSTRUCTURED_API_KEY (CLI) or api_key=os.getenv("UNSTRUCTURED_API_KEY") (Python)
  • --partition-endpoint $UNSTRUCTURED_API_URL (CLI) or partition_endpoint=os.getenv("UNSTRUCTURED_API_URL") (Python)
  • The environment variables UNSTRUCTURED_API_KEY and UNSTRUCTURED_API_URL
• To send files to the Unstructured Partition Endpoint for processing, specify --partition-by-api (CLI) or partition_by_api=True (Python). Unstructured also requires an Unstructured API key and API URL, by adding the following:
  • --api-key $UNSTRUCTURED_API_KEY (CLI) or api_key=os.getenv("UNSTRUCTURED_API_KEY") (Python)
  • --partition-endpoint $UNSTRUCTURED_API_URL (CLI) or partition_endpoint=os.getenv("UNSTRUCTURED_API_URL") (Python)
  • The environment variables UNSTRUCTURED_API_KEY and UNSTRUCTURED_API_URL, representing your API key and API URL, respectively.
  You must specify the API URL only if you are not using the default API URL for Unstructured Ingest, for example, if you are using a self-hosted instance of the Unstructured API.The default API URL for Unstructured Ingest is https://api.unstructuredapp.io/general/v0/general, which is the API URL for the Unstructured Partition Endpoint. However, you should always use the URL that was provided to you when your Unstructured account was created. If you do not have this URL, contact Unstructured Sales at sales@unstructured.io.If you do not have an API key, get one now.If the Unstructured API is self-hosted, the process for generating Unstructured API keys, and the Unstructured API URL that you use, are different. For details, contact Unstructured Sales at sales@unstructured.io.

​

Add an access policy to an existing bucket

1. Sign in to the AWS Management Console.
2. Open the Amazon S3 Console.
3. Browse to the existing bucket and open it.
4. Click the Permissions tab.
5. In the Bucket policy area, click Edit.
6. In the Policy text area, copy the following JSON-formatted policy. To change the following policy to restrict it to a specific user in the AWS account, change root to that specific username. In this policy, replace the following:
   • Replace <my-account-id> with your AWS account ID.
   • Replace <my-bucket-name> in two places with the name of your bucket.
   Copy

   Ask AI

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowAuthenticatedUsersInAccountReadWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::<my-account-id>:root"
               },
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject",
                   "s3:ListBucket",
                   "s3:DeleteObject"
               ],
               "Resource": [
                   "arn:aws:s3:::<my-bucket-name>",
                   "arn:aws:s3:::<my-bucket-name>/*"
               ],
               "Condition": {
                   "StringEquals": {
                       "aws:PrincipalType": "IAMUser"
                   }
               }
           }
       ]
   }
   

7. Click Save changes.

​

Create a bucket with the AWS CLI

1. Install the AWS CLI.
2. Set up the AWS CLI.
3. Copy the following script to a file on your local machine, for example a file named create-s3-bucket.sh. To change the following bucket policy to restrict it to a specific user in the AWS account, change root to that specific username. In this script, replace the following:
   • Replace <my-account-id> with your AWS account ID.
   • Replace <my-unique-bucket-name> with the name of your bucket.
   • Replace <us-east-1> with your AWS Region.
   Copy

   Ask AI

   #!/bin/bash
   
   # Set variables for the AWS account ID, Amazon S3 bucket name, and AWS Region.
   ACCOUNT_ID="<my-account-id>"
   BUCKET_NAME="<my-unique-bucket-name>"
   REGION="<us-east-1>"
   
   # Temporary filename for the bucket policy.
   # Do not change this variable.
   POLICY_FILE="bucket_policy.json"
   
   # Create the bucket.
   aws s3api create-bucket --bucket $BUCKET_NAME --region $REGION
   
   # Wait for the bucket to exist.
   echo "Waiting for bucket '$BUCKET_NAME' to be fully created..."
   aws s3api wait bucket-exists --bucket $BUCKET_NAME
   
   # Check if the wait command was successful.
   if [ $? -eq 0 ]; then
       echo "The bucket '$BUCKET_NAME' has been fully created."
   else
       echo "Error: Timed out waiting for bucket '$BUCKET_NAME' to be created."
       exit 1
   fi
   
   # Remove the "block public policy" bucket access setting.
   aws s3api put-public-access-block \
       --bucket $BUCKET_NAME \
       --public-access-block-configuration \
       '{"BlockPublicPolicy": false, "IgnorePublicAcls": false, "BlockPublicAcls": false, "RestrictPublicBuckets": false}'
   
   # Check if the operation was successful.
   if [ $? -eq 0 ]; then
       echo "The block public policy access setting was removed from '$BUCKET_NAME'."
   else
       echo "Error: Failed to remove the block public policy access setting from '$BUCKET_NAME'."
       exit 1
   fi
   
   # Create the bucket policy.
   cat << EOF > $POLICY_FILE
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowAuthenticatedUsersInAccountReadWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::$ACCOUNT_ID:root"
               },
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject",
                   "s3:ListBucket",
                   "s3:DeleteObject"
               ],
               "Resource": [
                   "arn:aws:s3:::$BUCKET_NAME",
                   "arn:aws:s3:::$BUCKET_NAME/*"
               ],
               "Condition": {
                   "StringEquals": {
                       "aws:PrincipalType": "IAMUser"
                   }
               }
           }
       ]
   }
   EOF
   
   # Apply the bucket policy.
   aws s3api put-bucket-policy --bucket $BUCKET_NAME --policy file://$POLICY_FILE
   
   # Check if the policy application was successful.
   if [ $? -eq 0 ]; then
       echo "The bucket policy was applied to '$BUCKET_NAME'."
   else
       echo "Error: Failed to apply the bucket policy to '$BUCKET_NAME'."
       exit 1
   fi
   
   # Verify the applied policy.
   echo "Verifying the applied policy:"
   aws s3api get-bucket-policy --bucket $BUCKET_NAME --query Policy --output text
   
   # Remove the temporary bucket policy file.
   rm $POLICY_FILE
   

4. Run the script, for example:
   Copy

   Ask AI

   sh create-s3-bucket.sh
   

5. After the bucket is created, you can delete the script file, if you want.

​

Create a bucket with AWS CloudFormation

1. Save the following YAML to a file on your local machine, for example create-s3-bucket.yaml. To change the following bucket policy to restrict it to a specific user in the AWS account, change root to that specific username.
   Copy

   Ask AI

   AWSTemplateFormatVersion: '2010-09-09'
   Description: 'CloudFormation template to create an S3 bucket with specific permissions for account users.'
   
   Parameters:
     BucketName:
       Type: String
       Description: 'Name of the S3 bucket to create'
   
   Resources:
     MyS3Bucket:
       Type: 'AWS::S3::Bucket'
       Properties:
         BucketName: !Ref BucketName
         PublicAccessBlockConfiguration:
           BlockPublicAcls: true
           BlockPublicPolicy: false
           IgnorePublicAcls: true
           RestrictPublicBuckets: true
   
     BucketPolicy:
       Type: 'AWS::S3::BucketPolicy'
       Properties:
         Bucket: !Ref MyS3Bucket
         PolicyDocument:
           Version: '2012-10-17'
           Statement:
             - Sid: AllowAllAuthenticatedUsersInAccount
               Effect: Allow
               Principal:
                 AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
               Action:
                 - 's3:GetObject'
                 - 's3:PutObject'
                 - 's3:ListBucket'
                 - 's3:DeleteObject'
               Resource:
                 - !Sub 'arn:aws:s3:::${BucketName}'
                 - !Sub 'arn:aws:s3:::${BucketName}/*'
   
   Outputs:
     BucketName:
       Description: 'Name of the created S3 bucket'
       Value: !Ref MyS3Bucket
   

2. Sign in to the AWS Management Console.
3. Open the AWS CloudFormation Console.
4. Click Create stack > With new resources (standard).
5. On the Create stack page, with Choose an existing template already selected, select Upload a template file.
6. Click Choose file, and browse to and select the YAML file from your local machine.
7. Click Next.
8. Enter a unique Stack name and BucketName.
9. Click Next two times.
10. Click Submit.
11. Wait until the Status changes to CREATE_COMPLETE.
12. After the bucket is created, you can delete the YAML file, if you want.