Storage Transfer Service can listen to event notifications in AWS to automatically transfer data that has been added or updated in the source location, into a Cloud Storage bucket. Learn more about the benefits of event-driven transfers.
Event-driven transfers listen to Amazon S3 Event Notifications sent to Amazon SQS to know when objects in the source bucket have been modified or added. Object deletions are not detected; deleting an object at the source does not delete the associated object in the destination bucket.
Create an SQS queue
In the AWS console, go to the Simple Queue Service page.
Click Create queue.
Enter a Name for this queue.
In the Access policy section, select Advanced. A JSON object is displayed:
{ "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__owner_statement", "Effect": "Allow", "Principal": { "AWS": "01234567890" }, "Action": [ "SQS:*" ], "Resource": "arn:aws:sqs:us-west-2:01234567890:test" } ] }
The values of
AWS
andResource
are unique for each project.Copy your specific values of
AWS
andResource
from the displayed JSON into the following JSON snippet:{ "Version": "2012-10-17", "Id": "example-ID", "Statement": [ { "Sid": "example-statement-ID", "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "SQS:SendMessage", "Resource": "RESOURCE", "Condition": { "StringEquals": { "aws:SourceAccount": "AWS" }, "ArnLike": { "aws:SourceArn": "S3_BUCKET_ARN" } } } ] }
The values of the placeholders in the preceding JSON use the following format:
- AWS is a numeric value representing your Amazon Web Services
project. For example,
"aws:SourceAccount": "1234567890"
. - RESOURCE is an Amazon Resource Number (ARN) that identifies
this queue. For example,
"Resource": "arn:aws:sqs:us-west-2:01234567890:test"
. - S3_BUCKET_ARN is an ARN that identifies the source bucket. For
example,
"aws:SourceArn": "arn:aws:s3:::example-aws-bucket"
. You can find a bucket's ARN from the Properties tab of the bucket details page in the AWS console.
- AWS is a numeric value representing your Amazon Web Services
project. For example,
Replace the JSON displayed in the Access policy section with the updated JSON above.
Click Create queue.
Once complete, note the Amazon Resource Name (ARN) of the queue. The ARN has the following format:
arn:aws:sqs:us-east-1:1234567890:event-queue"
Enable notifications on your S3 bucket
In the AWS console, go to the S3 page.
In the Buckets list, select your source bucket.
Select the Properties tab.
In the Event notifications section, click Create event notification.
Specify a name for this event.
In the Event types section, select All object create events.
As the Destination select SQS queue and select the queue you created for this transfer.
Click Save changes.
Configure permissions
Follow the instructions in Configure access to a source: Amazon S3 to create either an access key ID and secret key, or a Federated Identity role.
Replace the custom permissions JSON with the following:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:DeleteMessage", "sqs:ChangeMessageVisibility", "sqs:ReceiveMessage", "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::S3_BUCKET_NAME", "arn:aws:s3:::S3_BUCKET_NAME/*", "AWS_QUEUE_ARN" ] } ] }
Once created, note the following information:
- For a user, note the access key ID and secret key.
- For a Federated Identity role, note the Amazon Resource Name (ARN),
which has the format
arn:aws:iam::AWS_ACCOUNT:role/ROLE_NAME
.
Create a transfer job
You can use the REST API or the Google Cloud console to create an event-based transfer job.
Cloud console
Go to the Create transfer job page in the Google Cloud console.
Select Amazon S3 as the source type, and Cloud Storage as the destination.
As the Scheduling mode select Event-driven and click Next step.
Enter your S3 bucket name. The bucket name is the name as it appears in the AWS Management Console. For example,
my-aws-bucket
.Select your authentication method and enter the requested information, which you created and noted in the previous section.
Enter the Amazon SQS queue ARN that you created earlier. It uses the following format:
arn:aws:sqs:us-east-1:1234567890:event-queue"
Optionally, define any filters, then click Next step.
Select the destination Cloud Storage bucket and, optionally, path.
Optionally, enter a start and end time for the transfer. If you don't specify a time, the transfer will start immediately and will run until manually stopped.
Specify any transfer options. More information is available from the Create transfers page.
Click Create.
Once created, the transfer job starts running and an event listener waits for notifications on the SQS queue. The job details page shows one operation each hour, and includes details on data transferred for each job.
REST
To create an event-driven transfer using the REST API, send the following JSON object to the transferJobs.create endpoint:
transfer_job { "description": "YOUR DESCRIPTION", "status": "ENABLED", "projectId": "PROJECT_ID", "transferSpec" { "awsS3DataSource" { "bucketName": "AWS_SOURCE_NAME", "roleArn": "arn:aws:iam::1234567891011:role/role_for_federated_auth" }, "gcsDataSink": { "bucketName": "GCS_SINK_NAME" } } "eventStream" { "name": "arn:aws:sqs:us-east-1:1234567891011:s3-notification-queue", "eventStreamStartTime": "2022-12-02T01:00:00+00:00", "eventStreamExpirationTime": "2023-01-31T01:00:00+00:00" } }
The eventStreamStartTime
and eventStreamExpirationTime
are optional.
If the start time is omitted, the transfer starts immediately; if the end
time is omitted, the transfer continues until manually stopped.
Client libraries
Go
To learn how to install and use the client library for Storage Transfer Service, see Storage Transfer Service client libraries. For more information, see the Storage Transfer Service Go API reference documentation.
To authenticate to Storage Transfer Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Java
To learn how to install and use the client library for Storage Transfer Service, see Storage Transfer Service client libraries. For more information, see the Storage Transfer Service Java API reference documentation.
To authenticate to Storage Transfer Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Node.js
To learn how to install and use the client library for Storage Transfer Service, see Storage Transfer Service client libraries. For more information, see the Storage Transfer Service Node.js API reference documentation.
To authenticate to Storage Transfer Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.
Python
To learn how to install and use the client library for Storage Transfer Service, see Storage Transfer Service client libraries. For more information, see the Storage Transfer Service Python API reference documentation.
To authenticate to Storage Transfer Service, set up Application Default Credentials. For more information, see Set up authentication for a local development environment.