Sales Engine Setup & Configuration

Home /
Arlula Products /
Sales Engine /
Sales Engine Setup & Configuration

Coming Soon

More setup and configuration guides are coming soon, please watch this space.

Table of Contents

How to configure private storage for Sales Engine

Arlula’s Sales Engine platform is designed to support data being stored separately to your deployment, based on deployment requirements.

When setting up external storage, there are a few key cases to consider, each of which has different access regimes to consider, granting access to the appropriate systems necessary to fulfil your expected behavior.

Dataset storage → where customer data will be stored for access and download from your platform deployment
- requires access from the management and api systems (and optionally processing, if enabling automation)
Ingress storage → locations where third party suppliers can deliver data to in order to trigger automated fulfillment to a customer (when configured for s3 delivery)
- requires access from the management and processing systems
- may require s3 event configuration to enable automation (see below)
Scene storage → locations where full scenes are stored and where automatic scene indexation can find and retrieve new scenes
- requires access from the management and processing systems
- may require s3 event configuration to enable automation (see below)
Quarantine storage → the location that user uploaded files are stored while awaiting virus scanning (ADM deployments only)
- requires access from the management and virus scanner systems

For AWS S3, the setup of these storage locations takes the same form:

Create the storage bucket
Add a bucket policy granting the Arlula deployment the necessary permissions
Notify Arlula by emailing support@arlula.com with your new private storage location so that access policies can be updated

The policy necessary to access the storage takes the following form

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    ...
                    <system-roles>
                    ...
                ]
            },
            "Action": [
                <actions>
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

Where <system-roles> is the roles you are granting access to the objects, <actions> are the permissions being granted, and <bucket-name> is the bucket being granted access to.

NOTE: this default policy does not contain any deletion permissions, and these behaviors are left up to the bucket owner to configure appropriate bucket policies. Please reach out to Arlula support if you need support in this configuration.

Policy Configuration

To determine the required values for your policy, use the following tables (examples are available below):

US deployment (Ohio)

Purpose	Roles	Permissions
Dataset storage	arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals arn:aws:iam::615299753585:role/arlula-prod-iam-eks-apis arn:aws:iam::615299753585:role/arlula-prod-processing-iam-ecs-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging", "s3:PutObject", "s3:PutObjectTagging", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"
Ingress storage	arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals arn:aws:iam::615299753585:role/arlula-prod-processing-iam-ecs-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging"
Scene storage	arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals arn:aws:iam::615299753585:role/arlula-prod-processing-iam-ecs-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging"
Quarantine storage	arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals arn:aws:iam::615299753585:role/arlula-prod-virusscanning-iam-eks-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging", "s3:PutObject", "s3:PutObjectTagging", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"

EU deployment (Frankfurt)

Purpose	Roles	Permissions
Dataset storage	arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-apis arn:aws:iam::615299753585:role/arlula-eu-c-processing-iam-ecs-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging", "s3:PutObject", "s3:PutObjectTagging", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"
Ingress storage	arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals arn:aws:iam::615299753585:role/arlula-eu-c-processing-iam-ecs-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging"
Scene storage	arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals arn:aws:iam::615299753585:role/arlula-eu-c-processing-iam-ecs-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging"
Quarantine storage	arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals arn:aws:iam::615299753585:role/arlula-eu-c-virusscanning-iam-eks-role	"s3:ListBucket", "s3:GetObject", "s3:GetObjectTagging", "s3:PutObject", "s3:PutObjectTagging", "s3:ListBucketMultipartUploads", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"

Additional considerations

If creating an order storage bucket, it is recommended to establish a bucket CORS policy to mitigate common browser errors when downloading.

This bucket takes the form

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET"
        ],
        "AllowedOrigins": [
            "https://<your hostname>"
        ],
        "ExposeHeaders": [
            "ETag"
        ],
        "MaxAgeSeconds": 3000
    }
]

If configuring an ingress or scene bucket, it is recommended to enable s3 events for the bucket so that incoming or updated data can trigger automation for indexation and delivery.

To do this, enable event notifications for All object create events (s3:ObjectCreated:*) on the bucket, sending the events to the appropriate SQS Queue for your region (see the table below).

NOTE: this may require your account to already be authorized to create this record, so it is recommended you complete the above permission steps, and return to this step after informing Arlula of the new bucket and confirming that it has been configured.

Region	SQS Queue
US (Ohio)	arn:aws:sqs:us-east-2:615299753585:arlula-prod-processing-pipeline
EU (Frankfurt)	arn:aws:sqs:eu-central-1:615299753585:arlula-eu-c-processing-pipeline

Example Policies

US deployment (Ohio)

Dataset Storage
Ingress Storage
Scene Storage
Quarantine Storage

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-prod-iam-eks-apis",
                    "arn:aws:iam::615299753585:role/arlula-prod-processing-iam-ecs-role"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:PutObject",
                "s3:PutObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-prod-processing-iam-ecs-role"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-prod-processing-iam-ecs-role"
                ]
            },
            "Action": [
               "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-prod-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-prod-virusscanning-iam-eks-role"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:PutObject",
                "s3:PutObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

EU deployment (Frankfurt)

Dataset Storage
Ingress Storage
Scene Storage
Quarantine Storage

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-apis",
                    "arn:aws:iam::615299753585:role/arlula-eu-c-processing-iam-ecs-role"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:PutObject",
                "s3:PutObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-eu-c-processing-iam-ecs-role"
                ]
            },
            "Action": [
               "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-eu-c-processing-iam-ecs-role"
                ]
            },
            "Action": [
               "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::615299753585:role/arlula-eu-c-iam-eks-portals",
                    "arn:aws:iam::615299753585:role/arlula-eu-c-virusscanning-iam-eks-role"
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:PutObject",
                "s3:PutObjectTagging",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket-name>",
                "arn:aws:s3:::<bucket-name>/*"
            ]
        }
    ]
}