---
title: "Connect Amazon S3 data to Databricks with Delegated IAM Permissions"
description: "Databricks introduces a simpler flow for connecting Amazon S3 to Unity Catalog through an external location, addressing the manual work previously required to establish governed read and write access. Instead of writing 140-line IAM trust policies, configuring bucket permissions, deploying CloudFormation templates, and switching between consoles, users specify a bucket and access level, then verify permissions in AWS. AWS IAM temporary delegation lets Databricks provision a least-privilege IAM role, configure its cross-account trust policy, register the external location, and enable Auto Loader and File Events. The delegated authorization is time-bounded and expires after setup; provisioning actions are logged in AWS CloudTrail, and users without sufficient permissions can request access from an AWS administrator in the flow. The result is a single-session setup intended to reduce configuration errors while supporting governed S3 access for ingestion, pipelines, analytics, and LTAP workloads."
---

# Connect Amazon S3 data to Databricks with Delegated IAM Permissions

[Databricks](https://yomu.fyi/company/databricks) · Gordon Wang · Jul 23, 2026

**Type:** Announcement

## Summary

Databricks introduces a simpler flow for connecting Amazon S3 to Unity Catalog through an external location, addressing the manual work previously required to establish governed read and write access. Instead of writing 140-line IAM trust policies, configuring bucket permissions, deploying CloudFormation templates, and switching between consoles, users specify a bucket and access level, then verify permissions in AWS. AWS IAM temporary delegation lets Databricks provision a least-privilege IAM role, configure its cross-account trust policy, register the external location, and enable Auto Loader and File Events. The delegated authorization is time-bounded and expires after setup; provisioning actions are logged in AWS CloudTrail, and users without sufficient permissions can request access from an AWS administrator in the flow. The result is a single-session setup intended to reduce configuration errors while supporting governed S3 access for ingestion, pipelines, analytics, and LTAP workloads.

## Context

Connecting S3 to Databricks previously required authoring 140-line IAM trust policies, configuring bucket permissions, deploying CloudFormation templates, and switching between the AWS console and Databricks. These steps created common failure modes, including incorrect trust policies, missing bucket permissions, and misconfigured ARNs.

## Approach / What changed

The new external location flow uses AWS IAM temporary delegation. After users specify an S3 bucket and access level and verify their AWS permissions, Databricks provisions a least-privilege IAM role, configures the cross-account trust policy, registers the Unity Catalog external location, and enables Auto Loader and File Events.

## Takeaways

- An external location combines an S3 storage path with a storage credential and governs Databricks read and write access through Unity Catalog.
- AWS IAM temporary delegation gives Databricks time-bounded authorization to provision required resources; the authorization expires after setup and actions are logged in AWS CloudTrail.
- The automated flow creates the storage credential and external location while enabling Auto Loader and File Events automatically.

**Tags:** [AWS](https://yomu.fyi/topic/aws), [Databricks](https://yomu.fyi/topic/databricks)

- Source: [Databricks](https://www.databricks.com/blog/connect-amazon-s3-data-databricks-delegated-iam-permissions)
- Source URL: https://www.databricks.com/blog/connect-amazon-s3-data-databricks-delegated-iam-permissions
- Ingested by Yomu: 2026-08-30T16:53:41.250Z

[Read original post](https://www.databricks.com/blog/connect-amazon-s3-data-databricks-delegated-iam-permissions)