Delta Tables in Amazon S3

• An AWS account. Create an AWS account.
• An S3 bucket. You can create an S3 bucket by using the S3 console, following the steps in the S3 documentation or in the following video. Additional approaches that use AWS CloudFormation or the AWS CLI are in the how-to sections later on this page.
• For authenticated bucket write access or both, you should first block all public access to the bucket. After blocking all public access to the bucket, for read access, the authenticated AWS IAM user must have at minimum the permissions of s3:ListBucket and s3:GetObject for that bucket. For write access, the authenticated AWS IAM user must have at minimum the permission of s3:PutObject for that bucket. To grant permissions, attach the appropriate bucket policy to the bucket. See the policy examples later on this page, and learn about bucket policies for S3. These permissions remain in effect until the bucket policy is removed from the bucket. To apply a bucket policy by using the S3 console, follow the steps in the S3 documentation or in the following video. Additional approaches that use AWS CloudFormation or the AWS CLI are in the how-to sections later on this page.
• Provide an AWS access key and secret access key for the authenticated AWS IAM user in the account. Create an AWS access key and secret access key by following the steps in the IAM documentation or in the following video.
• If the target files are in the root of the bucket, provide the path to the bucket, formatted as protocol://bucket/ (for example, s3://my-bucket/). If the target files are in a folder, the path to the target folder in the S3 bucket, formatted as protocol://bucket/path/to/folder/ (for example, s3://my-bucket/my-folder/).
• If the target files are in a folder, make sure the authenticated AWS IAM user has authenticated access to the folder as well. See examples of authenticated folder access.

​

Add an access policy to an existing bucket

1. Sign in to the AWS Management Console.
2. Open the Amazon S3 Console.
3. Browse to the existing bucket and open it.
4. Click the Permissions tab.
5. In the Bucket policy area, click Edit.
6. In the Policy text area, copy the following JSON-formatted policy. To change the following policy to restrict it to a specific user in the AWS account, change root to that specific username. In this policy, replace the following:
   • Replace <my-account-id> with your AWS account ID.
   • Replace <my-bucket-name> in two places with the name of your bucket.
   Copy

   Ask AI

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowAuthenticatedUsersInAccountReadWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::<my-account-id>:root"
               },
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject",
                   "s3:ListBucket",
                   "s3:DeleteObject"
               ],
               "Resource": [
                   "arn:aws:s3:::<my-bucket-name>",
                   "arn:aws:s3:::<my-bucket-name>/*"
               ],
               "Condition": {
                   "StringEquals": {
                       "aws:PrincipalType": "IAMUser"
                   }
               }
           }
       ]
   }
   

7. Click Save changes.

​

Create a bucket with AWS CloudFormation

1. Save the following YAML to a file on your local machine, for example create-s3-bucket.yaml. To change the following bucket policy to restrict it to a specific user in the AWS account, change root to that specific username.
   Copy

   Ask AI

   AWSTemplateFormatVersion: '2010-09-09'
   Description: 'CloudFormation template to create an S3 bucket with specific permissions for account users.'
   
   Parameters:
     BucketName:
       Type: String
       Description: 'Name of the S3 bucket to create'
   
   Resources:
     MyS3Bucket:
       Type: 'AWS::S3::Bucket'
       Properties:
         BucketName: !Ref BucketName
         PublicAccessBlockConfiguration:
           BlockPublicAcls: true
           BlockPublicPolicy: false
           IgnorePublicAcls: true
           RestrictPublicBuckets: true
   
     BucketPolicy:
       Type: 'AWS::S3::BucketPolicy'
       Properties:
         Bucket: !Ref MyS3Bucket
         PolicyDocument:
           Version: '2012-10-17'
           Statement:
             - Sid: AllowAllAuthenticatedUsersInAccount
               Effect: Allow
               Principal:
                 AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
               Action:
                 - 's3:GetObject'
                 - 's3:PutObject'
                 - 's3:ListBucket'
                 - 's3:DeleteObject'
               Resource:
                 - !Sub 'arn:aws:s3:::${BucketName}'
                 - !Sub 'arn:aws:s3:::${BucketName}/*'
   
   Outputs:
     BucketName:
       Description: 'Name of the created S3 bucket'
       Value: !Ref MyS3Bucket
   

2. Sign in to the AWS Management Console.
3. Open the AWS CloudFormation Console.
4. Click Create stack > With new resources (standard).
5. On the Create stack page, with Choose an existing template already selected, select Upload a template file.
6. Click Choose file, and browse to and select the YAML file from your local machine.
7. Click Next.
8. Enter a unique Stack name and BucketName.
9. Click Next two times.
10. Click Submit.
11. Wait until the Status changes to CREATE_COMPLETE.
12. After the bucket is created, you can delete the YAML file, if you want.

​

Create a bucket with the AWS CLI

1. Install the AWS CLI.
2. Set up the AWS CLI.
3. Copy the following script to a file on your local machine, for example a file named create-s3-bucket.sh. To change the following bucket policy to restrict it to a specific user in the AWS account, change root to that specific username. In this script, replace the following:
   • Replace <my-account-id> with your AWS account ID.
   • Replace <my-unique-bucket-name> with the name of your bucket.
   • Replace <us-east-1> with your AWS Region.
   Copy

   Ask AI

   #!/bin/bash
   
   # Set variables for the AWS account ID, Amazon S3 bucket name, and AWS Region.
   ACCOUNT_ID="<my-account-id>"
   BUCKET_NAME="<my-unique-bucket-name>"
   REGION="<us-east-1>"
   
   # Temporary filename for the bucket policy.
   # Do not change this variable.
   POLICY_FILE="bucket_policy.json"
   
   # Create the bucket.
   aws s3api create-bucket --bucket $BUCKET_NAME --region $REGION
   
   # Wait for the bucket to exist.
   echo "Waiting for bucket '$BUCKET_NAME' to be fully created..."
   aws s3api wait bucket-exists --bucket $BUCKET_NAME
   
   # Check if the wait command was successful.
   if [ $? -eq 0 ]; then
       echo "The bucket '$BUCKET_NAME' has been fully created."
   else
       echo "Error: Timed out waiting for bucket '$BUCKET_NAME' to be created."
       exit 1
   fi
   
   # Remove the "block public policy" bucket access setting.
   aws s3api put-public-access-block \
       --bucket $BUCKET_NAME \
       --public-access-block-configuration \
       '{"BlockPublicPolicy": false, "IgnorePublicAcls": false, "BlockPublicAcls": false, "RestrictPublicBuckets": false}'
   
   # Check if the operation was successful.
   if [ $? -eq 0 ]; then
       echo "The block public policy access setting was removed from '$BUCKET_NAME'."
   else
       echo "Error: Failed to remove the block public policy access setting from '$BUCKET_NAME'."
       exit 1
   fi
   
   # Create the bucket policy.
   cat << EOF > $POLICY_FILE
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowAuthenticatedUsersInAccountReadWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::$ACCOUNT_ID:root"
               },
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject",
                   "s3:ListBucket",
                   "s3:DeleteObject"
               ],
               "Resource": [
                   "arn:aws:s3:::$BUCKET_NAME",
                   "arn:aws:s3:::$BUCKET_NAME/*"
               ],
               "Condition": {
                   "StringEquals": {
                       "aws:PrincipalType": "IAMUser"
                   }
               }
           }
       ]
   }
   EOF
   
   # Apply the bucket policy.
   aws s3api put-bucket-policy --bucket $BUCKET_NAME --policy file://$POLICY_FILE
   
   # Check if the policy application was successful.
   if [ $? -eq 0 ]; then
       echo "The bucket policy was applied to '$BUCKET_NAME'."
   else
       echo "Error: Failed to apply the bucket policy to '$BUCKET_NAME'."
       exit 1
   fi
   
   # Verify the applied policy.
   echo "Verifying the applied policy:"
   aws s3api get-bucket-policy --bucket $BUCKET_NAME --query Policy --output text
   
   # Remove the temporary bucket policy file.
   rm $POLICY_FILE
   

4. Run the script, for example:
   Copy

   Ask AI

   sh create-s3-bucket.sh
   

5. After the bucket is created, you can delete the script file, if you want.

​

Delta table output format

• Initially, one Parquet (.parquet) file per file in the source location. For example, for a file in the source location named my-file.pdf, an associated file with the extension .parquet is generated. Various kinds of file transactions can result in additional Parquet files being generated. These Parquet filenames are automatically generated by the Delta Lake engine and are not meant to be manually modified.
• A folder named _delta_log that contains metadata and change history about the .parquet files. As Parquet files are added to, changed, or removed from the specified bucket or folder path, the _delta_log folder is updated with any related metadata and change history details.

• In the source location, each set of source files that is to be considered as a unit for change management purposes should be controlled by a unique, dedicated Delta Tables in S3 destination connector. This connector should reference a unique, dedicated output folder within the bucket. Having multiple workflows refer to different sets of source files, yet all share the same Delta table, could results in data loss or table corruption.
• Avoid directly modifying, adding, or deleting Parquet data files or the _delta_log folder within a Delta table’s directory. This can lead to data loss or table corruption.
• If you need to copy or move a Delta table to a different location, you must move or copy its entire set of Parquet files and its associated _delta_log folder (and its contents) together as a unit. Note that the copied or moved Delta table will no longer be controlled by the original Delta Tables in S3 destination connector.

​

Create the destination connector

1. On the sidebar, click Connectors.
2. Click Destinations.
3. Cick New or Create Connector.
4. Give the connector some unique Name.
5. In the Provider area, click Delta Table.
6. Click Continue.
7. Follow the on-screen instructions to fill in the fields as described later on this page.
8. Click Save and Test.

• Name (required): A unique name for this connector.
• AWS Region (required): The AWS Region identifier (for example, us-east-1) for the Amazon S3 bucket you want to store the Delta Table in.
• Bucket URI (required): The URI of the Amazon S3 bucket you want to store the Delta Table in. This typically takes the format s3://my-bucket/my-folder.
• AWS Access Key ID (required): The AWS access key ID for the AWS IAM principal (such as an IAM user) that has the appropriate access to the S3 bucket.
• AWS Secret Access Key (required): The AWS secret access key for the corresponding AWS access key ID.