S3 Delivery
Configure how DataDrop writes exported files to Amazon S3.
Overview
Every warehouse connection includes an S3 output configuration. When a report runs, DataDrop exports the query results and writes them to the specified S3 bucket. The S3 configuration is set per warehouse connection, so all reports using that connection share the same delivery bucket.
S3 Parameters
| Parameter | Required | Description |
|---|---|---|
| s3_bucket | Required | The S3 bucket where exported files are written.e.g. my-delivery-bucket |
| s3_prefix_template | Optional | Path template inside the bucket. Supports dynamic variables.e.g. exports/{client_id}/{report_id}/{date}/ |
| aws_role_arn | Optional | IAM role ARN that DataDrop assumes to write to S3.e.g. arn:aws:iam::123456789:role/DeliveryS3Role |
Prefix Template Variables
The prefix template supports the following variables, which are replaced at runtime:
| Parameter | Required | Description |
|---|---|---|
| {client_id} | Optional | Replaced with the client's unique ID. |
| {report_id} | Optional | Replaced with the report's unique ID. |
| {date} | Optional | Replaced with the delivery date (YYYY-MM-DD format). |
Example
Template: exports/{client_id}/{report_id}/{date}/
Result: exports/abc123/rpt456/2025-01-15/
IAM Role Setup
DataDrop needs permission to write files to your S3 bucket. Create an IAM role with the following policy:
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::your-bucket/*",
"arn:aws:s3:::your-bucket"
]
}Set the role's trust policy to allow DataDrop's AWS account to assume it. Contact the DataDrop team for the exact account ID and external ID to use.
Bucket Configuration Tips
- Versioning — Enable S3 versioning so you can recover previous deliveries if needed.
- Lifecycle rules — Consider adding lifecycle rules to transition old deliveries to S3 Glacier or delete them after a retention period.
- Encryption — Use SSE-S3 or SSE-KMS encryption for data at rest.
- Separate buckets — For multi-tenant setups, consider using a separate prefix per client using the
{client_id}variable.