​

MoEngage × Amazon S3

​

Use Cases

• Synchronize real-time behavioral segments.
• Import users and events.
• Export campaign interaction events.

​

Advantages

​

Reduce Integration Time

• Eliminates the need for external Extract, Transform, and Load (ETL) tools.
• Replaces complex data pipelines with a one-time configuration process.
• Minimizes reliance on development and technology teams.

​

Faster Data Processing

• Processes and queries high-volume data in near real time.
• Propagates schema updates automatically without manual reconfigurations in MoEngage.
• Lowers data-transfer costs compared to traditional external cloud pipelines.

​

Integration

​

Step 1: Set Up Authentication

Cross account role Preferred — supports both imports and exports

In this method, you create one IAM role in your AWS account and allow a single MoEngage role to assume it. You need two values from MoEngage:

• MoEngage AWS Account ARN: The only MoEngage identity your role will trust.
• MoEngage External ID: A value unique to your workspace, in the format moe-external-xxxxxxxxxx.

Where to find these valuesIn MoEngage, go to Amazon S3 > Integrations > Add Connection. The MoEngage AWS Account ARN and your workspace’s MoEngage External ID appear on the Add Connection form (see Step 3: Connect Amazon S3 on the App Marketplace). Copy them before you configure AWS.

Create the cross account role

1. Sign in to the AWS Management Console and open the IAM service.
2. In the left navigation, choose Roles, and then click Create role.
3. For Trusted entity type, select Custom trust policy.
4. In the Custom trust policy editor, paste the following trust policy, replace the placeholders with the values from the App marketplace, and then click Next. The trust policy defines who may assume your role.
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "AllowMoEngageToAssume",
         "Effect": "Allow",
         "Principal": {
           "AWS": "<<MoEngage AWS Account ARN>>"
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "<<MoEngage External ID>>"
           }
         }
       }
     ]
   }
   
   The sts:ExternalId condition scopes this role to your workspace only. Do not change or remove it.
5. On the Add permissions screen, click Next. You attach the bucket permissions later, in Step 2: Grant Permissions.
6. On the Name, review, and create screen, enter a Role name that begins with the required prefix moe-export- (for example, moe-export-moengage-s3). A role whose name does not start with moe-export- fails to connect, because MoEngage can only assume roles with this prefix.
7. Click Create role.
8. Open the role you created and copy its Role ARN (for example, arn:aws:iam::111122223333:role/moe-export-moengage-s3). You paste this into the Add Connection page in Step 3.

After you create the role, attach the bucket permissions described in Step 2: Grant Permissions (Imports tab, Exports tab, or both).

Access key [Imports] — supports imports only

Instead of a role, you provide an AWS access key pair that has read access to your bucket.

1. In your AWS account, create an IAM user (or use an existing programmatic user) and generate an Access Key ID and Secret Access Key.
2. Attach a permission policy granting read access to your bucket (see Step 2: Grant Permissions → Imports tab).
3. Enter the Access Key ID and Secret Access Key on the Add Connection page (see Step 3: Connect Amazon S3 on the App Marketplace).

Access-key credentials are stored once as a reusable S3 connection in MoEngage, rather than being entered inside each import. Create the connection once (Step 3), and then select it when you configure any S3 import.

IAM Policy [Exports] — supports exports only

In this method, you grant MoEngage’s export role access directly through your S3 bucket policy (there is no role for MoEngage to assume). MoEngage uses a single export role for this method across all data centers, so no per-data-center ARN table is needed:

arn:aws:iam::612427630422:role/service-role/core_s3_export-role-e1qw8ulf

1. Open the AWS Management Console > S3, select your bucket, and go to Permissions > Bucket policy > Edit.
2. Add the following statement. Replace <INSERTPOLICYID> and <INSERTSID> with values of your choice (any unique identifiers), and your-bucket-name with your bucket name. Keep the MoEngage Principal ARN exactly as shown.

{
  "Version": "2012-10-17",
  "Id": "<INSERTPOLICYID>",
  "Statement": [
    {
      "Sid": "<INSERTSID>",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::612427630422:role/service-role/core_s3_export-role-e1qw8ulf"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3::<INSERTBUCKETNAME>/*"
    }
  ]
}

​

Step 2: Grant Permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MoEngageImportReadObjects",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::<INSERTBUCKETNAME>/*"
    },
    {
      "Sid": "MoEngageImportListBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::<INSERTBUCKETNAME>/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MoEngageExportWriteObjects",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::your-bucket-name/moengage/*"
    },
    {
      "Sid": "MoEngageExportListBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
      "Resource": "arn:aws:s3:::<INSERTBUCKETNAME>/*"
    }
  ]
}

​

Step 3: Connect Amazon S3 on the App Marketplace

1. On the left navigation menu in the MoEngage dashboard, click App marketplace.
2. On the App Marketplace page, search for Amazon S3.
3. Click the Amazon S3 tile.
4. On the Amazon S3 page, go to the Integrate tab and click +Add Connection.
5. In the S3 connections section, enter the following settings:

   Applies to	Field	Required	Description
   	Connection name	Yes	Type a unique name to identify the Amazon S3 connection.
   	Bucket name	Yes	Type the exact name of your Amazon S3 bucket. MoEngage uses this name to route imports and exports.
   	Bucket region	Optional	Select the AWS region hosting your target S3 bucket from the drop-down list.
   	Authentication method	Yes	Select an option to connect MoEngage with Amazon S3: Cross account role: Allows MoEngage to access your S3 bucket for imports and exports by assuming an IAM Role in your AWS account. This option increases security by eliminating long-term credential storage. Access key [Imports]: Authenticates imports using static programmatic AWS credentials (Access Key ID and Secret Key). IAM Policy [Exports]: Uses resource-level S3 bucket policies to authorize automated exports from MoEngage.
   Cross account role	MoEngage AWS Account ARN	Read-Only	Displays the MoEngage AWS account ARN (arn:aws:iam::582272135730:root). Copy this value to configure your AWS role’s Trust Relationship policy. This field appears only when you click Cross account role.
   	MoEngage External ID	Read-Only	Displays the MoEngage external security ID (moe-external-f82a6992-9c75-5d4c-f985-a0c3b8f3bcf2). Copy this value to configure your AWS role’s Trust Relationship policy. This field appears only when you click Cross account role.
   	Your AWS role ARN	Conditional	Type the Amazon Resource Name (ARN) of the AWS IAM role configured with a trust relationship to MoEngage. This field is required only when you click Cross account role, enter AWS role ARN.
   Access key [Imports]	Access Key ID	Conditional	Type the programmatic Access Key ID generated for your AWS user. This field is required only when you click Access key [Imports], enter Access Key ID.
   	Secret Key	Conditional	Type the secret programmatic access key generated for your AWS user. This field is required only when you click Access key [Imports], enter Secret Key.
   IAM Policy [Exports]	No credentials required	—	This method is for S3 exports only. You do not enter any credentials here. Instead, configure an IAM policy in your AWS account, and MoEngage uses that permission to deliver files to your S3 bucket during exports. To set up the bucket policy, see the IAM Policy [Exports] method in Step 1: Set Up Authentication. This field appears only when you click IAM Policy [Exports].

6. Click Test to validate your credentials, and then click Connect to activate the Amazon S3 integration.
   Configuration changes can take up to 15 minutes to propagate to your active campaigns and connections.

​

Import Users and Events

​

Export Events