--- title: Sharing Data with Chord from Cloud Storage slug: sharing-data-with-chord-from-cloud-storage docTags: createdAt: 2025-12-17T17:47:28.467Z --- # Introduction This guide provides step-by-step instructions for integrating external cloud storage services to Chord's data warehouse (Snowflake). We delegate authentication to Snowflake-managed identities, eliminating the need to manage credentials directly. Below you'll find instructions for connecting either AWS S3, Google Cloud Storage or Azure Blob Storage services to Chord's data warehouse (Snowflake). # Configuring an integration for AWS S3 This sections describes how to configure secure access to data files stored in an AWS S3 bucket. 1. Create an IAM Policy that has the permissions required to access the bucket and get objects: :::Paragraph{indent="3"} a. Log into the AWS Management Console. ::: :::Paragraph{indent="3"} b. From the home dashboard, search for and select **IAM.** ::: :::Paragraph{indent="3"} c. From the left-hand navigation pane, select **Account settings.** ::: :::Paragraph{indent="3"} d. Under **Security Token Service (STS)** in the Endpoints list, find the **United States (N. Virginia)** (i.e., `us-east-1`) region. If the **STS status** is inactive, move the toggle to **Active**. ::: :::Paragraph{indent="3"} e. Select **Create Policy.** ::: :::Paragraph{indent="3"} f. For **Policy editor**, select **JSON.** ::: :::Paragraph{indent="3"} g. Add a policy document that will allow Chord to access the S3 bucket and folder. The following policy (in JSON format) provides Chord with the required permissions to read data using a single bucket and folder path. Copy and paste the text into the policy editor: ::: :::CodeblockTabs{indent="3"} ```javascript { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource": "arn:aws:s3::://*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::", "Condition": { "StringLike": { "s3:prefix": [ "/*" ] } } } ] } ``` ::: :::Paragraph{indent="3"} h. Select **Next.** ::: :::Paragraph{indent="3"} i. Enter a **Policy name** and an optional Description. ::: :::Paragraph{indent="3"} j. Select **Create policy.** ::: 2. Create an IAM Role and attach the custom IAM role: :::Paragraph{indent="3"} a. From the left-hand navigation pane in the Identity and Access Management (IAM) Dashboard, select **Roles.** ::: :::Paragraph{indent="3"} b. Select **Create role.** ::: :::Paragraph{indent="3"} c. Select **AWS account** as the trusted entity type. ::: :::Paragraph{indent="3"} d. Select **Another AWS account.** ::: :::Paragraph{indent="3"} e. In the **Account ID** field, enter your own AWS account ID temporarily. Later, you will modify the trust relationship and grant access to Snowflake. ::: :::Paragraph{indent="3"} f. Select the **Require external ID **option. An external ID is used to grant access to your AWS resources (such as S3 buckets) to a third party like Snowflake. Enter a placeholder ID such as `0000`. In a later step, you will modify the trust relationship for your IAM role and specify the external ID that Chord will provide. ::: :::Paragraph{indent="3"} g. Select **Next.** ::: :::Paragraph{indent="3"} h. Select the IAM Policy you created in the previous step. ::: :::Paragraph{indent="3"} i. Select **Next.** ::: :::Paragraph{indent="3"} j. Enter a name and description for the role, then select **Create role**.You have now created an IAM policy, IAM role and attached the policy to the role. ::: :::Paragraph{indent="3"} k. On the role summary page, locate and record the **Role ARN** value. You will need to provide Chord this ARN to complete the next steps. ::: 3. Provide Chord the IAM Role ARN and bucket name. The full bucket name is a URL that will look like the following: `s3://my-cool-bucket/`. 4. Once your bucket name and IAM Role ARN is confirmed, Chord will provide an IAM User ARN and an AWS External ID 5. Grant the IAM User permissions to access bucket objects: :::Paragraph{indent="3"} a. Sign in to the AWS Management Console ::: :::Paragraph{indent="3"} b. Select **IAM** ::: :::Paragraph{indent="3"} c. From the left-hand navigation pane, select **Roles** ::: :::Paragraph{indent="3"} d. Select the IAM Role you created in the previous step ::: :::Paragraph{indent="3"} e. Select the **Trust relationships** tab ::: :::Paragraph{indent="3"} f. Select **Edit trust policy** ::: :::Paragraph{indent="3"} g. Modify the policy document with the values provided by Chord. This includes IAM User ARN and External ID. ::: :::CodeblockTabs{indent="3"} ```javascript { "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "AWS": "" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` ::: :::Paragraph{indent="3"} h. Select **Update policy** to save your changes. ::: # Configuring an integration for Google Cloud Storage This sections describes how to configure secure access to data files stored in a Google Cloud Storage bucket. 1. Provide Chord with your GCS `bucket` name. The bucket name is the name of the Cloud Storage bucket that stores your data files. The full bucket name is a URL that will look like the following: `gcs://my-cool-bucket/`. 2. Once your `bucket` name is confirmed, Chord will provide you a Cloud Storage service account name to be used in the following steps. 3. Create a custom role that has the permissions required to access the bucket and get objects: :::Paragraph{indent="3"} a. Sign in to the Google Cloud console as a project editor. ::: :::Paragraph{indent="3"} b. From the home dashboard, select **IAM & Admin** » **Roles** ::: :::Paragraph{indent="3"} c. Select **Create Role.** ::: :::Paragraph{indent="3"} d. Enter a **Title** and optional **Description** for the custom role. ::: :::Paragraph{indent="3"} e. Select **Add Permissions.** ::: :::Paragraph{indent="3"} f. Filter the list of permissions, and add the following from the list: `storage.buckets.get`, `storage.objects.get` and `storage.objects.list` ::: :::Paragraph{indent="3"} g. Select **Add.** ::: :::Paragraph{indent="3"} h. Select **Create.** ::: 4. Assign the custom role to the Cloud Storage Service Account: :::Paragraph{indent="3"} a. Sign in to the Google Cloud console as a project editor. ::: :::Paragraph{indent="3"} b. From the home dashboard, select **Cloud Storage** » **Buckets** ::: :::Paragraph{indent="3"} c. Filter the list of buckets, and select the in-scope bucket. ::: :::Paragraph{indent="3"} d. Select **Permissions** » **View by principals**, then select **Grant access.** ::: :::Paragraph{indent="3"} e. Under **Add principals**, paste the name of the service account name provided by Chord. ::: :::Paragraph{indent="3"} f. Under **Assign roles**, select the custom IAM role that you created previously, then select **Save.** ::: 5. (Optional) Grant the Cloud Storage service account permissions on the Cloud Key Management Service cryptographic keys: :::hint{type="info" indent="2"} This step is required ***only if *** your GCS bucket is encrypted using a key stored in the Google Cloud Key Management Service (Cloud KMS). ::: :::Paragraph{indent="3"} a. Sign in to the Google Cloud console as a project editor. ::: :::Paragraph{indent="3"} b. From the home dashboard, search for and select **Security** » **Key Management.** ::: :::Paragraph{indent="3"} c. Select the key ring that is assigned to your GCS bucket. ::: :::Paragraph{indent="3"} d. Click **SHOW INFO PANEL** in the upper-right corner. The information panel for the key ring slides out. ::: :::Paragraph{indent="3"} e. Click the **ADD PRINCIPAL** button. ::: :::Paragraph{indent="3"} f. In the **New principals** field, search for the service account name provided by Chord. ::: :::Paragraph{indent="3"} g. From the **Select a role** dropdown, select the "Cloud KMS CrytoKey Encryptor/Decryptor role". ::: :::Paragraph{indent="3"} h. Click the **Save** button. The service account name is added to the **Cloud KMS CrytoKey Encryptor/Decryptor role** dropdown in the information panel. ::: # Configuring an integration for Microsoft Azure Blob Storage This sections describes how to configure secure access to data files stored in Microsoft Azure Blob Storage. 1. Provide Chord with your `tenant_id` and `container name`. 2. Once your `tenant_id` and `container name` are confirmed, Chord will provide a consent URL and app name. 3. In a web browser, navigate to the consent URL. The page displays a Microsoft permissions request page. 4. Click the **Accept** button. This action allows the Azure service principal created for Chord’s Snowflake account to be granted an access token on specified resources inside your tenant. Obtaining an access token succeeds only if you grant the service principal the appropriate permissions on the container (see the next step). The Microsoft permissions request page redirects to the Snowflake corporate site (snowflake.com). 5. Sign in to the Microsoft Azure portal. 6. Navigate to **Azure Services** » **Storage Accounts**. Click the name of the storage account you are granting the Snowflake service principal access to. 7. Click **Access Control (IAM)** » **Add role assignment**. 8. Select the desired role to grant to the Snowflake service principal: **Storage Blob Data Reader grants read access only.** This allows loading data from files staged in the storage account. 9. Search for the Snowflake service principal. This is the identity in the app name property that we will provide. 10. Click the **Review + assign** button. # Troubleshooting :::hint{type="info"} This document has been created for customer reference purposes. For the most up-to-date information, you may consult official Snowflake documentation: - [AWS S3](https://docs.snowflake.com/en/user-guide/data-load-s3-config-storage-integration#configuring-secure-access-to-cloud-storage) - [Google Cloud Storage](https://docs.snowflake.com/en/user-guide/data-load-gcs-config#step-3-grant-the-service-account-permissions-to-access-bucket-objects) - [Microsoft Azure Blob Storage](https://docs.snowflake.com/en/user-guide/data-load-azure-config#step-2-grant-snowflake-access-to-the-storage-locations) ::: # Recommended next steps If you plan to use cloud storage integration to share data with Chord, we have some helpful recommendations for structuing data to faciliitate seemless data ingestion. See [Chord Data Source Ingestion Guidelines](docId\:XkTAjRAIlw5UnrQRmPAn9).