Skip to main content

How to Configure AWS S3 as a Destination for Tatango Report Builder

This guide walks you through setting up a secure AWS S3 bucket so Tatango can automatically deliver reports to your AWS environment.

D
Written by Dakota Fearn
Updated yesterday

This guide walks you through setting up a secure AWS S3 bucket so Tatango can automatically deliver reports to your AWS environment.

Tatango will upload report files directly to your S3 bucket using programmatic access credentials.

Overview

You will:

  1. Create a new private S3 bucket

  2. Create a restricted IAM user (no console access)

  3. Attach a minimal S3 write-only policy

  4. Generate access keys

  5. Provide Tatango with the required credentials

Step 1: Create a New S3 Bucket

  1. Log into AWS

  2. Navigate to S3

  3. Click Create bucket

  4. Configure the bucket:

    1. Required Settings

      1. Bucket name: Choose a globally unique name

      2. AWS Region: Choose the region where you want reports stored

      3. ACLs disabled (Bucket owner enforced)

      4. Block all public access: Enabled

  5. Click Create bucket

⚠️ The bucket must not be publicly accessible.

Step 2: Create a New IAM User

  1. Navigate to IAM → Users

  2. Click Create user

User Configuration

  • User name: Example: tatango-report-export

  • AWS Management Console access: ❌ Do NOT enable

    • This user should NOT have console access

    • Programmatic access only

Click Next

Step 3: Attach a Custom IAM Policy

You will now create and attach a policy that allows Tatango to upload files to your bucket.

Required Permission

Tatango only needs: s3:PutObject

Create the Policy

  1. In IAM, go to Policies

  2. Click Create policy

  3. Choose JSON

  4. Paste the policy below

  5. Click Next

  6. Name the policy (example: tatango-s3-report-upload)

  7. Create the policy

IAM Policy JSON

Replace {{ BUCKET_AME }} with your actual S3 bucket name.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::{{ BUCKET_NAME }}/*"
        }
    ]
}

Attach the Policy to the IAM User

  1. Return to IAM → Users

  2. Select the user you created

  3. Click Add permissions

  4. Choose Attach policies directly

  5. Select the policy you just created

  6. Click Add permissions

Step 4: Create Access Keys

  1. Open the IAM user

  2. Go to the Security credentials tab

  3. Click Create access key

  4. Select: Use case: CLI

  5. Confirm and create the key

  6. Copy and securely store:

    1. Access Key ID

    2. Secret Access Key

⚠️ You will only see the secret access key once. Save it securely.

Information Tatango Needs

You'll use the following when setting up the destination in Tatango:

Credentials

  • Access Key ID

  • Secret Access Key

S3 Configuration

  • AWS Region

  • Bucket Name

Optional: IP Whitelisting

If your security policy requires IP restrictions, you may whitelist Tatango’s outbound IP addresses.

All report delivery requests will originate from:

35.83.164.16
44.237.105.194
52.25.231.134
54.160.81.109

Example IAM User Configuration

Security Best Practices

We recommend:

  • Creating a dedicated S3 bucket for Tatango exports

  • Restricting the IAM user to s3:PutObject only

  • Disabling console access

  • Rotating access keys periodically

  • Monitoring bucket access logs if required

Did this answer your question?