Connecting to AWS-managed services

This page describes how to establish private connectivity between your dedicated instance and AWS-managed services. For self-hosted applications or AWS services that require a Network Load Balancer, see Connecting to customer-managed services on AWS.

AWS managed services

This section covers AWS-managed services that Unstructured can access using AWS-native private networking features, without requiring you to create a customer-managed endpoint service or Network Load Balancer.

The tables below use Order to indicate the general sequence of the information exchange — items with the same Order value can usually be provided at the same stage. Values like <DI_AWS_ACCOUNT_ID> and <UNSTRUCTURED_IAM_ROLE_ARN> are placeholders; contact your Unstructured account team or open a ticket in the Unstructured Support Portal to get the actual values for your dedicated instance.

Each AWS service you connect to via PrivateLink must be in the same AWS region as your dedicated instance — cross-region PrivateLink is not supported. The example region codes in the tables below are illustrative; use the region your dedicated instance is deployed in. See Known limitations.

AWS S3 (gateway endpoint)

Order	Information Required	Description	Example	Owner
1	S3 Bucket Name	Buckets Unstructured needs to access	my-documents	Customer
1	S3 Bucket Region	Region where bucket is located	us-east-1	Customer
2	Unstructured IAM Role ARN	IAM Role ARN that will access S3	<UNSTRUCTURED_IAM_ROLE_ARN>	Unstructured

This section also covers Delta Tables in Amazon S3 — the S3 Gateway Endpoint configuration is the same.

Example S3 Bucket Policy

You must create a bucket policy that grants Unstructured’s IAM Role access to the required S3 buckets.

For read-only access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowUnstructuredAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<UNSTRUCTURED_IAM_ROLE_ARN>"
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::<BUCKET_NAME>",
        "arn:aws:s3:::<BUCKET_NAME>/*"
      ]
    }
  ]
}

Use this Action clause for write access (e.g., if S3 is a destination):

{
  "Action": [
    "s3:GetObject",
    "s3:PutObject",
    "s3:DeleteObject",
    "s3:ListBucket"
  ]
}

Replace:

• <UNSTRUCTURED_IAM_ROLE_ARN> — Unstructured’s IAM Role ARN (provided during setup).
• <BUCKET_NAME> — Your S3 bucket name.

---

AWS Bedrock

Amazon Bedrock is accessed via AWS-provided VPC endpoints. Unstructured configures VPC endpoints in our VPC to ensure all traffic to Bedrock stays off the public internet. Access to customer-specific Bedrock resources is controlled via IAM policies.

Order	Information Required	Description	Example	Owner
1	Bedrock Region	AWS region where Bedrock resources are located	us-east-1	Customer
1	Model IDs / ARNs	Foundation models or custom models to access	anthropic.claude-sonnet-4-5, arn:aws:bedrock:us-east-1:123456789012:custom-model/my-model	Customer
2	Unstructured AWS Account ID	Account ID to allow in IAM/resource policies	<DI_AWS_ACCOUNT_ID>	Unstructured
2	Unstructured IAM Role ARN	IAM Role ARN that will access Bedrock	<UNSTRUCTURED_IAM_ROLE_ARN>	Unstructured

Unstructured configures the Bedrock VPC endpoint on the Unstructured platform. You must create IAM policies that grant access to Unstructured’s IAM Role.

Example IAM Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowBedrockModelInvocation",
      "Effect": "Allow",
      "Principal": {
        "AWS": "<UNSTRUCTURED_IAM_ROLE_ARN>"
      },
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:<REGION>::foundation-model/anthropic.claude-sonnet-4-5-*",
        "arn:aws:bedrock:<REGION>::foundation-model/anthropic.claude-opus-4-5-*",
        "arn:aws:bedrock:<REGION>:<CUSTOMER_ACC_NO>:custom-model/*"
      ]
    }
  ]
}

Replace:

• <UNSTRUCTURED_IAM_ROLE_ARN> — Unstructured’s AWS IAM Role ARN (provided during setup).
• <CUSTOMER_ACC_NO> — Your AWS Account ID.
• <REGION> — Your Bedrock region.

---

Amazon Managed Streaming for Apache Kafka (MSK)

Amazon MSK supports native multi-VPC private connectivity via PrivateLink. This enables Unstructured to connect to the customer’s MSK cluster (as a Kafka source) entirely within the AWS private network. You must have an MSK cluster with Multi-VPC Connectivity enabled.

MSK Multi-VPC Connectivity requires MSK cluster type provisioned (not serverless). The cluster must use TLS or SASL/TLS authentication.

Order	Information Required	Description	Example	Owner
1	MSK Cluster ARN	ARN of the MSK cluster	arn:aws:kafka:us-east-1:123456789012:cluster/my-cluster/abc-123	Customer
1	MSK Cluster Region	AWS region where cluster is deployed	us-east-1	Customer
1	Kafka Port	Port the brokers listen on	9094 (TLS) or 9096 (SASL/TLS)	Customer
1	Topic Name(s)	Kafka topics Unstructured needs to read	documents-raw, documents-processed	Customer
2	Unstructured AWS Account ID	Account ID to add as allowed principal	<DI_AWS_ACCOUNT_ID>	Unstructured
3	VPC Endpoint Service Name	Service name created when Multi-VPC Connectivity is enabled	com.amazonaws.vpce.us-east-1.vpce-svc-0abc123	Customer
3	Bootstrap Broker Endpoints	Private broker DNS names for the cluster	b-1.mycluster.abc123.kafka.us-east-1.amazonaws.com:9094	Customer

Enabling MSK Multi-VPC Connectivity

Use the AWS Console:

1. Navigate to Amazon MSK > select your cluster.
2. Choose Actions > Edit cluster connectivity.
3. Enable Multi-VPC connectivity.
4. Confirm — MSK will create a VPC Endpoint Service automatically.

Use the AWS CLI:

aws kafka update-connectivity \
  --cluster-arn "<MSK_CLUSTER_ARN>" \
  --connectivity-info '{
    "VpcConnectivity": {
      "ClientAuthentication": {
        "Tls": { "Enabled": true }
      }
    }
  }'

After enabling, retrieve the VPC Endpoint Service name:

aws kafka describe-cluster \
  --cluster-arn "<MSK_CLUSTER_ARN>" \
  --query 'ClusterInfo.BrokerNodeGroupInfo.ConnectivityInfo'

Adding Unstructured as an Allowed Principal

Once Multi-VPC Connectivity is enabled, use the AWS CLI to add Unstructured’s AWS Account ID as an allowed principal on the endpoint service:

aws ec2 modify-vpc-endpoint-service-permissions \
  --service-id <MSK_ENDPOINT_SERVICE_ID> \
  --add-allowed-principals "arn:aws:iam::<UNSTRUCTURED_AWS_ACCOUNT_ID>:root"

Replace:

• <MSK_ENDPOINT_SERVICE_ID> — The endpoint service ID created by MSK Multi-VPC Connectivity.
• <UNSTRUCTURED_AWS_ACCOUNT_ID> — Unstructured’s AWS Account ID (provided during setup).

---

Amazon OpenSearch Service

Amazon OpenSearch Service supports native Interface VPC Endpoints. Unstructured creates a VPC endpoint in our VPC targeting the customer’s OpenSearch domain.

Order	Information Required	Description	Example	Owner
1	OpenSearch Domain ARN	ARN of the OpenSearch domain	arn:aws:es:us-east-1:123456789012:domain/my-domain	Customer
1	OpenSearch Domain Region	AWS region where domain is deployed	us-east-1	Customer
1	Service Port	Port the service listens on	443	Customer
2	Unstructured AWS Account ID	Account ID to add as allowed principal	<DI_AWS_ACCOUNT_ID>	Unstructured
2	Unstructured IAM Role ARN	IAM Role that will access OpenSearch	<UNSTRUCTURED_IAM_ROLE_ARN>	Unstructured
3	VPC Endpoint DNS	The endpoint DNS name for connection	vpc-my-domain-xyz.us-east-1.es.amazonaws.com	Customer

Example Domain Access Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<UNSTRUCTURED_IAM_ROLE_ARN>"
      },
      "Action": [
        "es:ESHttpGet",
        "es:ESHttpHead",
        "es:ESHttpPost",
        "es:ESHttpPut",
        "es:ESHttpDelete"
      ],
      "Resource": "arn:aws:es:<REGION>:<CUSTOMER_ACC_NO>:domain/<DOMAIN_NAME>/*"
    }
  ]
}

Replace:

• <UNSTRUCTURED_IAM_ROLE_ARN> — Unstructured’s AWS Role ARN (provided during setup).
• <CUSTOMER_ACC_NO> — Your AWS Account ID.
• <REGION> — Your OpenSearch region.
• <DOMAIN_NAME> — Your OpenSearch domain name.

---

AWS OpenSearch Serverless

OpenSearch Serverless uses a fundamentally different access model compared to OpenSearch Service. It does not use resource-based access policies. Instead, access is controlled through data access policies and network access policies tied to VPC endpoints.

Order	Information Required	Description	Example	Owner
1	Collection Name	Name of the OpenSearch Serverless collection	my-vector-store	Customer
1	Collection ARN	Full ARN of the collection	arn:aws:aoss:us-east-1:123456789012:collection/abc123	Customer
1	Collection Endpoint	HTTPS endpoint of the collection	abc123.us-east-1.aoss.amazonaws.com	Customer
1	Collection Region	AWS region where collection is deployed	us-east-1	Customer
2	Unstructured AWS Account ID	Account ID to add to network access policy	<DI_AWS_ACCOUNT_ID>	Unstructured
2	Unstructured IAM Role ARN	IAM Role ARN to grant data access	<UNSTRUCTURED_IAM_ROLE_ARN>	Unstructured
3	VPC Endpoint ID	VPC endpoint ID created by Unstructured for aoss.amazonaws.com	vpce-0abc123def456789	Unstructured

Step 1: Create a Network Access Policy

The network access policy must allow Unstructured’s VPC endpoint to access the collection. Create or update the network policy for your collection:

[
  {
    "Rules": [
      {
        "Resource": ["collection/my-vector-store"],
        "ResourceType": "collection"
      }
    ],
    "AllowFromPublic": false,
    "SourceVPCEs": ["<UNSTRUCTURED_VPC_ENDPOINT_ID>"]
  }
]

Using AWS CLI:

aws opensearchserverless update-security-policy \
  --name "my-network-policy" \
  --type network \
  --policy '[{"Rules":[{"Resource":["collection/my-vector-store"],"ResourceType":"collection"}],"AllowFromPublic":false,"SourceVPCEs":["<UNSTRUCTURED_VPC_ENDPOINT_ID>"]}]'

Step 2: Create a Data Access Policy

The data access policy grants Unstructured’s IAM Role permissions to read/write the collection’s indexes.

For a vector store destination (read/write):

[
  {
    "Rules": [
      {
        "Resource": ["index/my-vector-store/*"],
        "Permission": [
          "aoss:CreateIndex",
          "aoss:DeleteIndex",
          "aoss:UpdateIndex",
          "aoss:DescribeIndex",
          "aoss:ReadDocument",
          "aoss:WriteDocument"
        ],
        "ResourceType": "index"
      },
      {
        "Resource": ["collection/my-vector-store"],
        "Permission": ["aoss:DescribeCollectionItems"],
        "ResourceType": "collection"
      }
    ],
    "Principal": ["<UNSTRUCTURED_IAM_ROLE_ARN>"]
  }
]

Using AWS CLI:

aws opensearchserverless create-access-policy \
  --name "unstructured-access" \
  --type data \
  --policy '[{"Rules":[{"Resource":["index/my-vector-store/*"],"Permission":["aoss:CreateIndex","aoss:DeleteIndex","aoss:UpdateIndex","aoss:DescribeIndex","aoss:ReadDocument","aoss:WriteDocument"],"ResourceType":"index"},{"Resource":["collection/my-vector-store"],"Permission":["aoss:DescribeCollectionItems"],"ResourceType":"collection"}],"Principal":["<UNSTRUCTURED_IAM_ROLE_ARN>"]}]'

Replace:

• <UNSTRUCTURED_VPC_ENDPOINT_ID> — VPC Endpoint ID provided by Unstructured (from Step 2 of the information exchange).
• <UNSTRUCTURED_IAM_ROLE_ARN> — Unstructured’s IAM Role ARN (provided during setup).
• my-vector-store — Your OpenSearch Serverless collection name.

---

AWS Databricks

Databricks on AWS supports native PrivateLink connectivity. The customer must have a Databricks Enterprise plan with a customer-managed VPC and PrivateLink enabled on their workspace.

Order	Information Required	Description	Example	Owner
1	Databricks Workspace URL	The workspace URL	myworkspace.cloud.databricks.com	Customer
1	Databricks Workspace Region	AWS region where workspace is deployed	us-east-1	Customer
1	Private Access Level	Whether access is at ACCOUNT or ENDPOINT level	ACCOUNT, ENDPOINT	Customer
2	Unstructured VPC Endpoint ID	VPC Endpoint ID to add to allowed list (if ENDPOINT level)	vpce-0abc123def456789	Unstructured
3	Workspace VPC Endpoint DNS	The private endpoint DNS for the workspace	myworkspace.privatelink.cloud.databricks.com	Customer

Example: Databricks Private Access Settings (ENDPOINT level)

If using ENDPOINT level access, add Unstructured’s VPC Endpoint ID to the allowed list via the Databricks Account Console or API:

{
  "private_access_settings_name": "unstructured-access",
  "region": "<REGION>",
  "public_access_enabled": false,
  "private_access_level": "ENDPOINT",
  "allowed_vpc_endpoint_ids": [
    "<UNSTRUCTURED_VPCE_ID>"
  ]
}

Replace:

• <UNSTRUCTURED_VPCE_ID> — VPC Endpoint ID provided by Unstructured.
• <REGION> — Your Databricks region.

For ACCOUNT level access, no explicit endpoint allowlisting is required — any VPC endpoint registered in the Databricks account can connect.

---

AWS Managed Services with native PrivateLink

Some AWS managed services support native PrivateLink endpoints. You must first create a VPC endpoint for the service. Unstructured then connects to it. This pattern applies to services like Amazon ElastiCache (Redis) and AWS Elasticsearch Service (legacy).

The Order column indicates the general sequence for the information exchange. Items with the same order value can usually be provided at the same stage.

Order	Information Required	Description	Example	Owner
1	Service Type	The AWS Service being accessed	ElastiCache, Elasticsearch	Customer
1	Service Region	Region where the service is hosted	us-east-1	Customer
1	Service Port	Port the service listens on	6379 (Redis), 443 (Elasticsearch)	Customer
1	Resource ARN	ARN of the resource	arn:aws:elasticache:us-east-1:123456789012:cluster/my-cache	Customer
2	Unstructured AWS Account ID	Account ID to add as allowed principal	<DI_AWS_ACCOUNT_ID>	Unstructured
2	Unstructured IAM Role ARN	IAM Role that will access the service	<UNSTRUCTURED_IAM_ROLE_ARN>	Unstructured
3	VPC Endpoint ID	The service-managed VPC endpoint ID	vpce-0abc123def456789	Customer
3	VPC Endpoint DNS	The endpoint DNS name for connection	vpce-0abc123.us-east-1.es.amazonaws.com	Customer