Skip to main content

Setting up File Mover Express

Before you use File Mover Express for the first time, complete the following tasks.

Prerequisites​

Sign up for an AWS account​

If you do not have an AWS account, complete the following steps to create one.

To sign up for an AWS account​

  1. Open https://portal.aws.amazon.com/billing/signup.
  2. Follow the online instructions.
  3. AWS sends you a confirmation email after the sign-up process is complete. At any time, you can view your current account activity and manage your account by going to https://aws.amazon.com/ and choosing My Account.

Create an administrative user​

After you sign up for an AWS account, create an administrative user so that you don't use the root user for everyday tasks.

Secure your AWS account root user​

  1. Sign in to the AWS Management Console as the account owner by choosing Root user and entering your AWS account email address. On the next page, enter your password.
  2. Turn on multi-factor authentication (MFA) for your root user.

Create an administrative user​

  1. For your daily administrative tasks, grant administrative access to an administrative user in AWS IAM Identity Center (successor to AWS Single Sign-On).
    • For instructions, see Getting started in the AWS IAM Identity Center User Guide.

Sign in as the administrative user​

  1. To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email address when you created the IAM Identity Center user.

Create an S3 bucket​

Important: Before you can use File Mover Express, you must complete the Setting up Amazon S3 tutorial. If Amazon S3 isn't properly configured, the security of the contents in your bucket could become compromised.

You must also complete the Create your first S3 bucket tutorial with these recommendations:

  • (Recommended) Enable Bucket Versioning in step 8:

    • This ensures that your data isn't lost if you accidentally overwrite a file in Amazon S3 with a new version.
    • Enabling bucket versioning accrues additional cost. For more information about Amazon S3 pricing, see the Amazon S3 pricing page.

  • (Recommended) Use AWS Key Management Service key (SSE-KMS) in step 11:

    • If you don't have an SSE-KMS key, create one by following the instructions in the Creating symmetric encryption KMS key tutorial.
    • For more information about different types of keys, see the Customer keys and AWS keys page.
    • To allow someone to use the bucket from another AWS account, you must use a customer managed key.
    • It's difficult to change the key after you create the bucket, so make sure that you create your bucket with the correct keys.

  • Leave all other settings and user preferences at their defaults.

Create an IAM Access Policy​

Next, you must create an IAM access policy that gives permission to the Amazon S3 bucket that you created. After that, you'll attach this IAM policy to an IAM user. This IAM user will generate the credentials that File Mover Express needs to access the Amazon S3 bucket.

Follow the Creating policies on the JSON tab tutorial in the IAM User Guide and use the appropriate JSON policy document below.

Using a Customer Managed Key from KMS (SSE-KMS)​

Enter the following text in the JSON template to provide the required access for Amazon S3 uploads and downloads:

Note: To allow deleting objects in the S3 bucket, include the actions listed in the statement with Sid "OptionalActions". You do not need to include those actions if you do not want to allow deleting S3 objects.

{ 
    "Statement": [ 
        {
            "Sid": "RequiredActions",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectTagging"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        },
        { 
            "Sid": "KMSKeyAccess", 
            "Action": [ 
                "kms:GenerateDataKey*", 
                "kms:Encrypt", 
                "kms:Decrypt" 
            ], 
            "Effect": "Allow", 
            "Resource": "arn:aws:kms:key-region:account-number:key/key-id" 
        },
        {
            "Sid": "OptionalActions",
            "Action": [
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:ListBucketVersions",
                "s3:AbortMultipartUpload"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ], 
    "Version": "2012-10-17" 
}

Replace the following placeholders:

  • bucket-name with the name of the bucket you created
  • key-region with the AWS Region where you created your key
  • account-number with your AWS account number
  • key-id with the ID of the KMS key you chose

To find the KMS key ID, follow the instructions in the Viewing the settings for an S3 Bucket Key tutorial.

Using an Amazon Managed KMS key (SSE-S3)​

  1. Check if your bucket has an active KMS key by following the instructions in the Viewing settings for an S3 Bucket Key tutorial.

    • If you aren't using a KMS key, proceed to step 2.
    • If you do have a KMS key attached to the bucket, follow the instructions for Using a Customer Managed Key from KMS (SSE-KMS) above.

  2. Enter the following text in the JSON template:

{
    "Statement": [
        {
            "Sid": "RequiredActions",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectTagging"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        },
        {
            "Sid": "OptionalActions",
            "Action": [
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:ListBucketVersions",
                "s3:AbortMultipartUpload"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ],
    "Version": "2012-10-17"
}

Replace bucket-name with the name of the bucket you created.

Set up the AWS CLI​

Install and configure the AWS CLI if you haven't already. File Mover Express uses AWS CLI named profiles to handle and store IAM credentials.

  1. Install or upgrade the AWS CLI by following the instructions in Installing the AWS Command Line Interface version 2.

  2. Configure the AWS CLI by following the instructions in Configuration and credential file settings.

  3. Verify that you created an AWS named profile by running:

    aws --profile [name of profile you created in step 2] sts get-caller-identity

    Example: This command should generate output similar to:

    aws --profile filemoverexpress sts get-caller-identity
    {
        "UserId": "ARXXXXXXXXXXXXXXXXXXX:username",
        "Account": "123456789012",
        "Arn": "arn:aws:sts::123456789012:XXXXXXXXXXXXXXX..."
    }

We recommend reading about additional AWS CLI security controls in the AWS Command Line Interface User Guide.

(Optional) AWS IAM Identity Center with External Identity Provider​

AWS IAM Identity Center is a cloud-based single sign-on service for managing users and groups. IAM Identity Center can be integrated with your enterprise SSO provider so users can sign in with their company account.

If you are using AWS IAM Identity Center to authenticate identities from another Identity Provider through SAML 2.0, see the AWS IAM Identity Center documentation for detailed configuration instructions.

Next Steps​

After completing the setup, proceed to: