Connect cloud storage with keys

Bring documents from Azure Blob Storage, Amazon S3 or Google Cloud Storage into your Knowledge Base. These three connect with a read-only key you create, rather than a sign-in. This guide walks you through each one step by step.

What this is

Your files stay where they are. SoftSolz uses the key to list the files in one container or bucket and read the ones you choose to import. It never changes, moves or deletes anything in your storage.

Before you start

• You need access to the cloud account that owns the storage, with permission to create users, keys or access tokens. If someone else manages it, send them the section for your provider.
• Allow about 10 minutes.
• In SoftSolz, open Marketplace → Connect Apps → Built-in apps and find the card in the files group. Click Set up. The window shows the same steps as this guide on the right.

Which one do I need?

Azure Blob Storage

You give SoftSolz a SAS URL: a link that grants read and list access to one container until a date you choose.

1. Find the container

1. Sign in to the Azure portal and open Storage accounts.
2. Click the storage account that holds your files.
3. In the left menu under Data storage, click Containers, then click the container you want to bring in.

2. Create a SAS URL

1. Inside the container, click Shared access tokens in the left menu.
2. Signing method: Account key.
3. Permissions: tick Read and List only. Leave Add, Create, Write and Delete unticked.
4. Start and expiry: set an expiry far enough ahead, for example one year. When it expires, SoftSolz asks you to reconnect.
5. Allowed protocols: HTTPS only.
6. Click Generate SAS token and URL.
7. Copy the Blob SAS URL, not the token on its own. It starts with https:// followed by your account name and .blob.core.windows.net/ and the container name.

3. Connect in SoftSolz

1. On the Azure Blob Storage card, click Set up.
2. Paste the URL into Container SAS URL and click Connect.
3. SoftSolz checks it straight away. If it works, the card shows Connected and the file browser opens.

Amazon S3

You create a separate AWS user that can only read one bucket, and give SoftSolz its access key. Never use your main account's keys.

1. Note your bucket name and region

1. Open the S3 console.
2. Find the bucket that holds your files. Note its exact name and its AWS Region code, shown in the list, for example eu-west-2 for London.

2. Create a read-only user

1. Open IAM → Users and click Create user.
2. User name: softsolz-reader. Leave Provide user access to the AWS Management Console unticked. Click Next.
3. On Set permissions, skip adding anything for now. Click Next, then Create user.

3. Let it read only that bucket

1. Click the new user, open the Permissions tab, click Add permissions and choose Create inline policy.
2. Switch to JSON and paste the policy below, replacing your-bucket-name in both places with your bucket name.
3. Click Next, name it softsolz-read-one-bucket and click Create policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket-name"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}

4. Create an access key

1. On the user, open the Security credentials tab and click Create access key.
2. Choose Third-party service, tick the confirmation and click Next, then Create access key.
3. Copy the Access key and the Secret access key. AWS shows the secret only once.

5. Connect in SoftSolz

1. On the Amazon S3 card, click Set up.
2. Fill in Access key ID, Secret access key, Region and Bucket name, then click Connect.

Google Cloud Storage

You create a service account that can only read your bucket, then an HMAC key for it. An HMAC key is a pair of values (an access key and a secret) that Google provides for tools like SoftSolz.

1. Note your bucket name

1. Open Cloud Storage → Buckets and pick the right project at the top.
2. Note the exact name of the bucket that holds your files.

2. Create a service account

1. Open IAM & Admin → Service accounts and click Create service account.
2. Name: softsolz-reader. Click Create and continue.
3. Skip the optional role and user steps and click Done. You give it access to the bucket only, in the next step.

3. Give it read access to the bucket

1. Go back to Cloud Storage → Buckets and click your bucket.
2. Open the Permissions tab and click Grant access.
3. New principals: paste the service account's email, which looks like softsolz-reader@your-project.iam.gserviceaccount.com.
4. Role: Storage Object Viewer. Click Save.

4. Create an HMAC key

1. Open Cloud Storage → Settings → Interoperability.
2. Under Service account HMAC, click Create a key for a service account and choose softsolz-reader.
3. Copy the Access key and the Secret. Google shows the secret only once.

5. Connect in SoftSolz

1. On the Google Cloud Storage card, click Set up.
2. Fill in HMAC access key, HMAC secret and Bucket name, then click Connect.

Bring files in

Once connected, the file browser opens. Pick the files or folders you want and choose the Knowledge Base collection to put them in. You can come back any time with Browse files on the card, and use Connect another to add a second container or bucket.

What the values look like

These are made-up examples so you can recognise the right value. Never paste your real values into an email or chat.

If something goes wrong

Keeping your keys safe

• Give read and list access only, to one container or bucket. Never use an account owner or admin key.
• SoftSolz encrypts the values before storing them and never shows them again.
• Never send a key or SAS URL by email or chat, and never post a screenshot of one.
• If a key is ever exposed, delete it in your cloud console straight away, create a new one and reconnect.

Remove a connection

Click Manage on the card and remove the connection. Files you already imported stay in your Knowledge Base. To cut access completely, also delete the key, user or SAS in your cloud console.