Amazon S3 - Nimble Docs

A Job can read its input set from an S3 bucket and write its assembled results back to one. Both directions are wired through a single bucket policy that grants Nimble’s IAM principal access to specific prefixes. Nimble does not assume a role in the customer account. Use Test Connection in the Job form to verify the policy before saving the job.

Nimble’s IAM principal

Every Job runs under a single IAM user:

arn:aws:iam::744254827463:user/crawlit-scrapy

Use this ARN as the Principal in the bucket policy.

Required permissions

Prefix	Permission
`s3://YOUR_BUCKET` (whole bucket)	`s3:ListBucket`
`s3://YOUR_BUCKET/input/*`	`s3:GetObject`
`s3://YOUR_BUCKET/output/*`	`s3:GetObject`, `s3:PutObject`, `s3:AbortMultipartUpload`, `s3:ListMultipartUploadParts`

s3:AbortMultipartUpload and s3:ListMultipartUploadParts are required because large output files are written in parts. If an upload fails mid-way, Nimble aborts the incomplete multipart upload so partial bytes do not accumulate in the bucket.

s3:DeleteObject is not requested. Nimble never deletes files in the bucket - including the connection-test probe described below.

Bucket policy template

Replace YOUR_BUCKET with the bucket name. Adjust the input/ and output/ prefixes to match the paths used in the Job form.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "NimbleListBucket",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::744254827463:user/crawlit-scrapy" },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::YOUR_BUCKET"
    },
    {
      "Sid": "NimbleReadInputPrefix",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::744254827463:user/crawlit-scrapy" },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET/input/*"
    },
    {
      "Sid": "NimbleReadWriteOutputPrefix",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::744254827463:user/crawlit-scrapy" },
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::YOUR_BUCKET/output/*"
    }
  ]
}

Applying the policy

Open the bucket

In the AWS Console, open S3 and click the bucket Nimble should access.

Edit the bucket policy

Open the Permissions tab. Click Edit under Bucket policy.

Paste the template

Paste the JSON above. Replace YOUR_BUCKET and the prefixes. Save changes.

Verify in Nimble

Open the Job form. Paste the s3://... path and click Test Connection. A green chip confirms the policy is correct.

Keep Block Public Access enabled. The policy grants access only to Nimble’s IAM user, not to the public.

Test Connection - what it does

Mode	Operation	Verifies
Read (input path)	`head_bucket` + list one object under the prefix	`s3:ListBucket` + `s3:GetObject`
Write (output path)	`head_bucket` + `put_object` of an empty `.nimble-connection-test` file at the prefix	`s3:ListBucket` + `s3:PutObject`

The write test leaves an empty .nimble-connection-test file under the output prefix. The file is not deleted - the policy does not grant s3:DeleteObject, so cleanup is not possible. The key is deterministic, so repeated tests overwrite the same object. At most one residue file per output prefix. Remove it manually at any time.

Interpreting the result

Chip	Meaning	Fix
✓ Connection OK	Permissions correct. The prefix has files.	Ready to use.
✓ Connection OK - prefix is empty	Permissions correct. The prefix has no files yet.	Upload the first input file.
✗ Access denied	The bucket policy is missing a required permission.	Re-apply the template above.
✗ Bucket does not exist	The bucket name in the path is wrong.	Verify the bucket name.
✗ Connection failed	Network, throttling, or unexpected S3 error.	Retry. Contact support if it persists.

All connections

Browse every Job storage connector.

Databricks

Connect a Job via Delta Sharing instead.

​Nimble’s IAM principal

​Required permissions

​Bucket policy template

​Applying the policy

​Test Connection - what it does

​Interpreting the result

​Related

All connections

Databricks

Nimble’s IAM principal

Required permissions

Bucket policy template

Applying the policy

Test Connection - what it does

Interpreting the result

Related