> ## Documentation Index
> Fetch the complete documentation index at: https://unstructured-53-doc-4-secrets-api.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Connect for AWS

> Enterprise Connect lets Unstructured connectors access AWS resources by assuming a customer-configured IAM role with temporary, scoped credentials.

<Note>
  Enterprise Connect is available for [dedicated instance](/business/dedicated-instances/overview) customers only. Contact your Unstructured account team or [Unstructured Support](https://support.unstructured.io/) to have it enabled on your instance.
</Note>

## Enterprise Connect credential model

Enterprise Connect is an authentication method that provides workspace-level credential management for AWS connectors. When a connector runs, Unstructured uses AWS Security Token Service (STS) to assume an IAM role in your AWS account and receive temporary credentials. No credentials are stored; they expire automatically.

## Supported AWS connectors

Enterprise Connect supports the following AWS connectors:

* AWS S3
* AWS OpenSearch

## How Enterprise Connect works

When a connector runs, Unstructured uses a verified AWS identity to obtain temporary credentials from AWS STS, without storing them.

1. In your AWS account, create an IAM role and attach a trust policy that permits Unstructured's service role to assume it. The trust policy includes an external ID, a unique value you generate and provide. Because only you know this value, only your workspace can trigger the role assumption, preventing the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
2. When a connector runs, it uses the AWS STS [`AssumeRole`](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) API to assume your IAM role and receive temporary, least-privilege credentials.
3. Unstructured uses the temporary credentials for that operation only and never stores them.

## Requirements

Enterprise Connect requires the following:

* A dedicated instance provisioned for your Unstructured account, with Enterprise Connect enabled. Contact your Unstructured account team or [Unstructured Support](https://support.unstructured.io/) to request access and have it enabled.
* An AWS account where you can create and manage IAM roles.

## Configure your connector

Select your preferred interface (Pipelines or API) to view setup instructions for your connector.

<Note>
  A connector configured with Enterprise Connect is available only in the workspace where it was created. It is not accessible from other workspaces in your Unstructured account.
</Note>

| Connector      | Source                                                                                                                                                                            | Destination                                                                                                                                                                                 |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWS S3         | [Pipelines](/pipelines/sources/s3#set-up-enterprise-connect-authentication) \| [API](/api-reference/workflow/sources/s3#set-up-enterprise-connect-authentication)                 | [Pipelines](/pipelines/destinations/s3#set-up-enterprise-connect-authentication) \| [API](/api-reference/workflow/destinations/s3#set-up-enterprise-connect-authentication)                 |
| AWS OpenSearch | [Pipelines](/pipelines/sources/opensearch#set-up-enterprise-connect-authentication) \| [API](/api-reference/workflow/sources/opensearch#set-up-enterprise-connect-authentication) | [Pipelines](/pipelines/destinations/opensearch#set-up-enterprise-connect-authentication) \| [API](/api-reference/workflow/destinations/opensearch#set-up-enterprise-connect-authentication) |