Configure a Bridge with AWS S3

Introduction

An AWS S3 Bridge is a one-way bridge that receives events via AWS object storage.

Configure Service

1. Configure the service by filling out the following:

   • Event Broker Space – the space where the bridge will operate

   • Name – the name you want to call the bridge

   • Bucket – the path of the container where the messages will be stored

   • AWS Region for Bucket – the AWS region where your S3 bucket is located

   • AWS Role (to Assume) – the Amazon Resource Name (ARN) of the IAM role that the Event Broker Bridge will assume to access your S3 bucket; this role must be configured with appropriate permissions and a trust policy allowing the Event Broker to assume it

   • AWS Role's External Id – a unique identifier that provides additional security when the Event Broker assumes your AWS role; this shared secret ensures that only authorized Mendix Event Broker instances can assume the role

     For instructions on creating the IAM role and obtaining these values, see the Configure AWS Authentication section below.

   

2. Click Next to connect events to your bridge.

Connect Events

To connect business events to AWS S3, follow these steps:

1. Click Add Business Events to open a dialog box that displays all events managed by the Event Broker, including Mendix app-defined events and uploaded AsyncAPI events. Only events that can publish appear, as this bridge operates in one direction.

2. Select the events to integrate and specify the prefix path for event storage.

   

3. Click Next to proceed to the confirmation screen.

Editing Bridges

You can edit an AWS S3 bridge to modify the configuration as your integration requirements evolve, without recreating it. For an AWS S3 bridge, you can:

• Add or remove Business Events
• Update Bucket, AWS Region for Bucket, or Prefix Path

To edit a bridge:

1. On the Event Broker Manager page, navigate to the Event Broker Bridges tab.

2. Click the bridge you want to modify.

3. Click Edit to enter editing mode. In editing mode, you can perform the following actions:

   • Add Business Events:

     1. Click Add Business Events to open a dialog that displays available events.
     2. Select the events you want to add and click Select. Added events display an Added badge and can be removed before applying changes.

   • Remove Business Events:

     1. Navigate to the event you want to remove and click Remove. Removed events display a Removed badge, and their name and metadata appear grayed out.
     2. Re-add a removed event by clicking Add before applying changes.

   • Update Service Configuration:

     • Update the Bucket, AWS Region for Bucket, or Prefix Path as needed

4. After you make your changes, you can:

   • Click Apply to save and apply the changes. A confirmation message indicates whether the changes were successful. Changes to the event configuration take effect when applied. After applying changes, the bridge status changes to Reconfiguring and returns to Running when reconfiguration is complete.
   • Click Cancel to exit editing mode without saving any changes.

Configure AWS Authentication

The Mendix Event Broker runs in AWS and uses cross-account authentication to securely access your S3 bucket. This authentication mechanism uses AWS IAM roles with trust policies and external IDs to ensure secure, controlled access.

Prerequisites

• Access to your AWS account with permissions to create and manage IAM roles
• An S3 bucket where business events will be stored
• The Mendix Event Broker AWS account ID: 044806572671

Create an IAM Role with a Trust Policy

The trust policy defines which AWS accounts can assume the role.

1. Navigate to IAM > Roles in your AWS Console.
2. Click Create role.
3. Select AWS account as the trusted entity type.
4. Choose Another AWS account.
5. Enter the Mendix Event Broker AWS account ID: 044806572671
6. Select Require external ID and enter a unique external ID of your choice. You need this external ID when configuring the bridge in Event Broker Manager.
7. Click Next.

Attach Permissions Policy to the Role

The permissions policy defines what actions the Event Broker can perform once the role is assumed.

1. Click Create policy to create a new policy, or select an existing policy.

2. If creating a new policy, use the following JSON template to grant the necessary S3 permissions:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowWriteObjects",
               "Effect": "Allow",
               "Action": [
                   "s3:PutObject",
                   "s3:PutObjectAcl",
                   "s3:DeleteObject"
               ],
               "Resource": "arn:aws:s3:::BUCKET_NAME/*"
           },
           {
               "Sid": "AllowListBucket",
               "Effect": "Allow",
               "Action": "s3:ListBucket",
               "Resource": "arn:aws:s3:::BUCKET_NAME"
           }
       ]
   }

3. Replace BUCKET_NAME with your actual S3 bucket name.

4. Name your policy (for example, EventBrokerS3WritePolicy) and create it.

5. Attach the policy to your IAM role.

6. Click Next.

Complete Role Creation

1. Provide a name for your role (for example, EventBrokerS3AccessRole).
2. Review the role configuration and click Create role.
3. After creating the role, open it and copy the Role ARN (for example, arn:aws:iam::YOUR_ACCOUNT_ID:role/EventBrokerS3AccessRole).

Configure the Bridge

Use the Role ARN and External ID when configuring your AWS S3 bridge in the Event Broker Manager.