# Creating Storage Connections

Storage Connections enable AI applications to access your Amazon S3 buckets through Vendia MCP Gateway. This guide covers the complete setup process, including AWS IAM configuration and creating storage connections in the Vendia platform.

## Prerequisites

Before creating Storage Connections, ensure you have:

1. **AWS IAM Role**: A role with appropriate permissions for the S3 buckets you want to access

2. **S3 Bucket Access**: Access to the S3 bucket(s) you want to use through AI applications. If you do not have an S3 bucket or AWS account, see [How to Create an AWS S3 Bucket](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/supplemental-guides/how-to-create-s3-bucket) for step-by-step instructions.

3. **Vendia Account Permissions**: Permissions to configure Storage Connections in your Vendia account

## Step 1: Start Storage Connection Configuration in Vendia

Start the configuration process in Vendia to obtain the required AWS account numbers:

1. In your Vendia dashboard, click **Go to my MCP Project**.

2. Go to **Storage Connections**.

3. Click the **\+ Connection** button.

4. **Note the Vendia AWS account numbers** displayed in the UI — you will need these to configure the IAM trust relationship.

## Step 2: Configure IAM Trust Relationship

Using the account numbers from [Step 1](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/creating-storage-connections/#step-1-start-storage-connection-configuration-in-vendia), configure the AWS IAM role that Vendia will assume to access your S3 bucket(s).

Grant Vendia access to your S3 bucket by adding a trust relationship to your IAM role:

1. Go to the AWS IAM dashboard (click **All Services > IAM**).

2. In the left navigation, click **Roles**. On the Roles page, either select an existing role or create a new role, then follow these steps:

3. Click **Create role**.

4. Under **Select trusted entity**, select **Custom trust policy**.

5. Under **Custom trust policy**, add or merge the trust relationship by copy-pasting the policy shown below.

```
{
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": [
             "arn:aws:iam::VENDIA_ACCOUNT_ID1:root",
             "arn:aws:iam::VENDIA_ACCOUNT_ID2:root"
           ]
         },
         "Action": "sts:AssumeRole"
       }
     ]
}
```

6. Click **Next**.

7. On the **Add permissions** step, click **Next**.

8. On the **Name, review and create** step, enter the role name (e.g., vendia-mcp-access) and add a description.

9. Review your trusted entities and click **Create role**.

## Step 3: Configure IAM Permissions

Choose the appropriate permission set based on your intended use case:

1. Click the **Permissions** tab for the selected IAM role.

2. Click **Add permissions** and then click **Create inline policy**.

3. On the **Specify permissions** page, you can either select **Visual** or **JSON** in the policy editor.

For most users, we recommend using the JSON editor for precise control and security. See below for JSON policy examples and instructions.

### Option A: Read-Only Access (Full Bucket)

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my-s3-bucket", "arn:aws:s3:::my-s3-bucket/*"]
    }
  ]
}
```

### Option B: Read and Write Access (Full Bucket)

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket", "s3:PutObject"],
      "Resource": ["arn:aws:s3:::my-s3-bucket", "arn:aws:s3:::my-s3-bucket/*"]
    }
  ]
}
```

### Option C: Complete Access (Read, Write, and Delete - Full Bucket)

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket", "s3:PutObject", "s3:DeleteObject"],
      "Resource": ["arn:aws:s3:::my-s3-bucket", "arn:aws:s3:::my-s3-bucket/*"]
    }
  ]
}
```

### Option D: Segregated Directories (Recommended for Enhanced Security)

Replace `my-s3-bucket`, `my-read-folder`, `my-write-folder`, and `my-temp-folder` with your actual bucket and folder names.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::my-s3-bucket"
    },
    {
      "Sid": "AllowReadFromSpecificFolder",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-s3-bucket/my-read-folder/*"
    },
    {
      "Sid": "AllowWriteToSpecificFolder",
      "Effect": "Allow",
      "Action": ["s3:PutObject"],
      "Resource": "arn:aws:s3:::my-s3-bucket/my-write-folder/*"
    },
    {
      "Sid": "AllowDeleteInSpecificFolder",
      "Effect": "Allow",
      "Action": ["s3:DeleteObject"],
      "Resource": "arn:aws:s3:::my-s3-bucket/my-temp-folder/*"
    }
  ]
}
```

Copy-paste your chosen policy into the editor and click **Next**.

1. On the **Review and create** step, enter the policy name (e.g., vendia-mcp-s3-policy) and review the permissions.

2. Click **Create policy** to finish.

## Step 4: Complete Storage Connection Configuration in Vendia

Return to **Storage Connections** in the Vendia dashboard to complete the configuration:

1. Provide the following information in the Storage Connection configuration dialog (from [Step 1](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/creating-storage-connections/#step-1-start-storage-connection-configuration-in-vendia)):
   - **Name**: A friendly name to identify this storage connection configuration
   - **Role ARN**: The ARN of the AWS role that Vendia will assume (configured in [Step 2](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/creating-storage-connections/#step-2-configure-iam-trust-relationship) and [Step 3](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/creating-storage-connections/#step-3-configure-iam-permissions);
     
you can copy-paste it from the role information page in the IAM dashboard)
   - **S3 Bucket Name**: The name of the S3 bucket you want to access
   - **Bucket Region**: The AWS region where your S3 bucket is located (create your bucket in a region that is supported by Vendia)
2. **Configure Access Policies**:

You’ll be asked: “Give AI agents full access to all files and folders in this S3 bucket?”
   - **Select Yes** to grant AI agents full access (all actions) to all files and folders in the bucket
   - **Select No, I’d like to decide exactly which files/folders are accessible after creating this Storage Connection** to configure specific access policies after creation, allowing you to control exactly which files and folders AI agents can access and what operations they can perform
3. **Advanced Settings** (Optional):

Expand the “Advanced settings” section if you need to configure client-side encryption:
   - **Encryption Key** (Optional): The encryption master key if using client-side encryption
4. Click **Create Storage Connection** to complete the setup:

You will see your newly created Storage Connection in the list:

5. If you selected **No** in [step 2 above](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/creating-storage-connections/#step-4-complete-storage-connection-configuration-in-vendia), configure access policies now:
   - Navigate to the **Access Policy** tab of your newly created Storage Connection
   - Click **\+ Add Path** to define which files and folders AI agents can access
   - See [Access Policies](https://docs.vendia.com/platform/vendia-mcp-server/storage-connections/access-policies) for detailed instructions on how to specify which files and folders are accessible, set granular permissions, and manage AI agent access to your S3 bucket.

## Using Your Storage Connection

After configuration, you can:

- **View S3 file metadata from within Vendia**: Browse your connected S3 bucket and see file names, sizes, last modified timestamps, and file types directly in the Vendia interface
- **Enable AI Application Access**: Allow MCP-compatible AI applications to access files in your connected S3 buckets
- **Manage access configurations**: Modify or delete storage connection configurations as needed

## Need Help?

If you encounter issues during setup or have questions about creating Storage Connections:

### Free Tier Support

- Review the [MCP Free Tier FAQ](https://docs.vendia.com/platform/free-tier-faq) for Free Tier-specific questions
- Submit questions via our [contact form](https://www.vendia.com/contact-us/) (online support only)

### Enterprise Tier Support

- Review our [MCP Server FAQ](https://docs.vendia.com/platform/vendia-mcp-server/faq) for common questions
- Contact [Vendia Support](mailto:support@vendia.com) for technical assistance.