Amazon S3

Use this guide if you can create IAM roles in the AWS account that owns the bucket and you are a Kimpton organization owner or admin. Kimpton connects through a role you control; do not create or share a long-lived AWS access key.

Before you start: Have the AWS account ID, bucket name, region, and an optional key prefix ready. Choose read-only unless Kimpton must save generated files back to S3. The prefix limits what Kimpton can list and read. Buckets encrypted with a customer-managed KMS key are not supported by this connection.

Connect the bucketCopy Anchor Link

1. In Kimpton, open Settings → Integrations → + Connection → Amazon S3. Enter the account ID, bucket, region, prefix, and access mode.
2. Copy the Custom trust policy JSON and Inline permissions policy JSON from your own connect screen. They contain values for your organization and bucket; do not copy a policy from someone else's setup.
3. In the owning AWS account, open IAM → Roles → Create role → Custom trust policy. Paste the trust policy from Kimpton and create the role.
4. On that role, choose Permissions → Add permissions → Create inline policy. Paste the permissions policy from Kimpton and save it. Check that its bucket, prefix, and access mode match what you intended.
5. Copy the new role ARN into Kimpton's Role ARN field and choose Activate connection.
6. Wait for a healthy status. Open Vault → Data Catalog and check that an expected object inside the prefix appears. If it does not, troubleshoot the connection.

The trust policy includes an external ID specific to your organization. Keep that value and the AWS principal exactly as Kimpton renders them. Read-only access needs bucket listing and object read permissions; object tags need s3:GetObjectTagging. Read and write adds object write and delete permissions. Review the generated policy with your AWS administrator before applying it.

To narrow access later, change the prefix or IAM policy. Removing the role or Kimpton connection revokes future access. S3 tags remain managed in S3 and refresh in Kimpton after sync.

If AWS denies access, compare the live role policies against the values in Kimpton's connect screen. Check the external ID, bucket, prefix, and encryption mode. Do not send the policy's external ID or other credentials to support; send the status and error text instead.