Skip to main content
An S3 bucket is connected by assuming a cross-account IAM role — there are no access keys. You create a role in your own AWS account that grants write access to your bucket and trusts Miru’s integration role to assume it.

​
How it works

You create a role in your AWS account that grants write access to the bucket and trusts Miru’s AWS role to assume it. AWS STS assume-role exchange When a device needs to upload data to you bucket:
  1. Miru assumes the role in your AWS account
  2. Miru creates a short-lived token scoped to the exact object key the device is uploading to
  3. Miru distributes the token to the device
  4. The device uploads the data to the bucket using the token
Connecting your bucket to Miru is a one-time setup that uses only identifiers and configuration values. No access keys, passwords, or long-lived tokens change hands in either direction.

​
Miru provides you

​
miru_role_arn
The AWS role Miru assumes into your account. You name this role as the trusted principal in your bucket role’s trust policy. This is a fixed value that never changes.arn:aws:iam::008971655189:role/MiruS3IntegrationRole
​
external_id
The external ID that must be present in your role’s trust policy, guarding against the confused deputy problem. Generated by Miru and shown in the dashboard — you fetch it from the UI and copy it into your trust policy.Example: wsp_123

​
You provide Miru

​
bucket_name
The name of your S3 bucket to connect to Miru.Example: my-upload-bucket
​
region
The region of the bucket.Example: us-east-1
​
role_arn
ARN of the IAM role in your account that Miru assumes to broker bucket access. Its trust policy must trust Miru’s integration role with the external ID.Example: arn:aws:iam::123456789012:role/miru-uploader

​
Connect a bucket

Follow the steps below to connect a bucket to Miru using the AWS CLI. To connect a bucket to Miru, you must hold the role.
1

Get your external ID from Miru

In the Miru dashboard, navigate to the Buckets page and click the + Bucket button in the top right corner.Switch to the S3 tab, copy your workspace’s external ID, and set it as a variable — the trust policy in a later step pins to this value so that only Miru, acting on behalf of your workspace, can assume the role.
Add Bucket Dialog with AWS External ID
2

Define the bucket

Set your bucket’s name and region.
Create the bucket if it doesn’t yet exist.
In us-east-1, omit --create-bucket-configuration — the API rejects a location constraint there.
3

Create a cross-account IAM role

Create an IAM role whose trust policy allows Miru’s integration role as the principal and requires your external ID via an sts:ExternalId condition.The external ID is the guard against the confused deputy problem: another tenant of the same Miru service cannot trick Miru into assuming your role without presenting your specific external ID.
The captured ${INTERNAL_ROLE_ARN} is your role_arn for registration.
4

Grant the role write access to the bucket

Attach a permissions policy granting s3:PutObject and s3:AbortMultipartUpload on the bucket. Devices upload via native S3 multipart uploads, and the abort permission lets a failed multipart upload clean up after itself.
Verification writes a zero-byte probe object under .miru/probe/.
5

Register the bucket in Miru

Print the values needed to register the bucket:
From the Buckets page in the Miru dashboard, select New bucket, choose AWS, and supply:
  • name — the name of the S3 bucket
  • region — the bucket’s region
  • role_arn — the role’s ARN
Select Create to register the bucket.
Last modified on July 21, 2026