Microsoft Entra and AWS S3 can work together to give precise, read-only access without giving away too much. The link between them is clean, fast, and secure when built with the right roles.
Microsoft Entra AWS S3 Read-Only Roles let you map identity from Entra directly to IAM permissions in AWS. The goal is simple: allow users to list and get objects from a specific S3 bucket, but block any write or delete. This prevents accidental data loss while maintaining controlled visibility.
To set it up, first create an IAM role in AWS. Assign the s3:GetObject and s3:ListBucket actions only to the bucket in scope. Attach a trust policy that lets Microsoft Entra federated identities assume this role via AWS Security Token Service (STS). Keep the trust boundaries tight—specify the Entra application’s client ID and audience in the policy so no other app can use it.
In Microsoft Entra, configure a federated identity credential for the relevant application. This links the Entra service principal to the AWS role. When the app requests access, it authenticates through Entra, gets a token, and exchanges it for AWS temporary credentials. The temporary nature of these credentials makes the system less exposed after use.