> ## Documentation Index
> Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Set Up an Amazon S3 Archive with AWS Console
> Use the AWS Management Console to configure your Amazon S3 bucket for trace and log rehydration in Honeycomb.
Ent+
Use the AWS Management Console to create the IAM policy and role that Honeycomb uses to access your S3 archive for trace and log rehydration.
This feature is available as an add-on for the [Honeycomb Enterprise plan](https://www.honeycomb.io/pricing/).
Please contact your Honeycomb account team for details.
To enable trace and log rehydration from your Amazon S3 archive, you will need an AWS IAM role that includes:
* Permissions to list and retrieve objects from your S3 bucket.
* A trust policy that allows the Honeycomb IAM role to assume this role when interacting with your archive.
This guide walks you through creating these resources in the AWS Management Console.
If you prefer, you can [use Terraform instead](/send-data/telemetry-pipeline/enhance/terraform-setup/).
After you create the IAM policy and role, share the details with your Honeycomb account team, so they can complete your S3 archive setup.
## Create an IAM Policy
First, create an IAM policy with permissions for listing and retrieving objects from your Amazon S3 bucket:
1. Sign in to the AWS Management Console and [open the IAM console](https://console.aws.amazon.com/iam/).
2. In the navigation pane, choose **Policies**.
3. Select **Create policy**.
4. In the Policy editor, choose the JSON option.
5. Copy the JSON policy that corresponds to your encryption method, then paste it into the editor:
Replace the placeholder ARNs in the `Resource` element with the actual ARNs for your bucket.
```json theme={}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessToArchiveBucket",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::/*",
"arn:aws:s3:::"
]
}
]
}
```
Replace the placeholder ARNs in the `Resource` elements with the actual ARNs for your bucket and AWS KMS key.
For the KMS key, specify the full key, not an alias.
```json theme={}
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAccessToArchiveBucket",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::/*",
"arn:aws:s3:::"
]
},
{
"Sid": "AllowKMSDecryptionOfArchiveBucket",
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": [
"arn:aws:kms:::key/"
]
}
]
}
```
6. Fix any warnings or errors if necessary, then select **Next**.
7. Provide a name and optional description for the policy.
Remember the policy name; you will use it when you create the IAM role.
8. Select **Create Policy**.
## Create the IAM Role
Next, create an IAM role that can access your Amazon S3 bucket, and authorize Honeycomb to assume that role when interacting with your bucket:
1. Sign in to the AWS Management Console and [open the IAM console](https://console.aws.amazon.com/iam/).
2. In the navigation pane, select **Roles**, and then choose **Create role**.
3. For the role type, select **Custom trust policy**.
4. In the Custom trust policy section, use the appropriate trust policy, depending on your team's Honeycomb instance:
**US:**
```json theme={}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::702835727665:role/production-eks-bulk-ingest-role"
},
"Action": "sts:AssumeRole"
}
]
}
```
**EU:**
```json theme={}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::919259170365:role/production-eu1-eks-bulk-ingest-role"
},
"Action": "sts:AssumeRole"
}
]
}
```
5. Select **Next**.
6. In the **Permissions policies** section, search for the name of the IAM policy that you created in the previous section.
7. Select the checkbox for that IAM policy in the results.
8. Skip the permissions boundary:
9. Select **Next**.
10. Provide a name and optional description for the IAM role.
11. Select **Create Role**.
**KMS Users: Check Your Key Policy**
If the data in your S3 bucket is encrypted with an AWS KMS encryption key, ensure that the corresponding [KMS Key Policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) allows this IAM Role to use the key to perform `kms:Decrypt` actions.
If the IAM Role does not have permission to decrypt using the KMS key, rehydration will fail.
## Share with Your Honeycomb Account Team
To complete your setup, share the following details with your Honeycomb account team:
* The name of your AWS S3 bucket
* The ARN of the IAM role that will interact with the bucket
To locate the IAM Role's ARN:
1. In the IAM service's navigation pane in the console, choose **Roles**.
2. Search for the name of the IAM role you created, then choose the role from the results.
3. In the **Summary** section, locate **ARN**, and use the copy icon to copy the ARN value to your clipboard.
* `s3_prefix` from your OpenTelemetry Collector exporter configuration, if configured
* `s3_partition_format` from your OpenTelemetry Collector exporter configuration, if configured
* `indexed_fields` from your OpenTelemetry Collector exporter configuration, if you configured custom indexed fields