Step 1. Create an AWS account

If you don't already have an Amazon Web Services (AWS) account, you can sign up for an AWS account(Link opens in a new window) at the AWS website.

Step 2. Create an Amazon S3 bucket and set up permissions

1. Create an Amazon S3 bucket to receive your log data. For more information, see Creating a bucket(Link opens in a new window) at the AWS website.

2. Configure the Amazon S3 bucket with the following settings:

   1. Under Object Ownership, select ACLs disabled (recommended). This ensures that the bucket owner is the owner of all objects written to it.

   2. Under Bucket Versioning, select Enable. Bucket versioning must be enabled in order to replicate objects.

   3. Under Default encryption, select Enable.

   4. Choose AWS Key Management Service (SSE-KMS).

   5. Choose Enter AWS KMS key ARN.

   6. Click the Create key button that appears to create a new AWS Key Management Service (KMS) key.

      Note: KMS multi-region keys aren't supported.

   7. Select Symmetric Key type and Encrypt and decrypt Key usage.

   8. Name the key with an alias, and then click through until the Review page.

   9. Add this statement to the key policy Statement list. Use the Role mapping by region table to find your region-specific role, and then replace HYPERFORCE-IAM-ROLE.

      {
          "Sid": "AllowTableauS3ReplicationSourceRoleToUseTheKey",
          "Effect": "Allow",
          "Principal": {
              "AWS": [
                  "HYPERFORCE-IAM-ROLE"
              ]
          },
          "Action": [
              "kms:GenerateDataKey",
              "kms:Encrypt"
          ],
          "Resource": "*"
      }

      Note: This statement allows the Hyperforce IAM role to encrypt the objects placed in the Amazon S3 bucket. For more information, see Using server-side encryption with AWS KMS keys (SSE-KMS)(Link opens in a new window) at the AWS website.

      • "kms:GenerateDataKey" is used to generate a data key to encrypt object replicas.

      • "kms:Encrypt" is used to encrypt object replicas created in the target S3 bucket.

      • "Resource": "*" grants permission for the KMS key only to the replication role and doesn't allow the role to elevate its permissions.

   10. Click Finish to create the KMS key.

   11. Click Create bucket to create the Amazon S3 bucket.

3. Update permissions on the Amazon S3 bucket policy.

1. Open the Amazon S3 bucket and click the Permissions tab.

2. Locate the Bucket policy section and click Edit.

3. Add this statement to the bucket policy Statement list.

   • Replace S3-BUCKET-NAME with the name of the bucket.

   • Use the Role mapping by region table to find your region-specific role, and then replace HYPERFORCE-IAM-ROLE.

   {
       "Sid": "TableauS3ReplicationRoleAccess",
       "Effect": "Allow",
       "Principal": {
           "AWS": [
               "HYPERFORCE-IAM-ROLE"
           ]
       },
       "Action": [
           "s3:ReplicateObject",
           "s3:ReplicateDelete"
       ],
       "Resource": [
           "arn:aws:s3:::S3-BUCKET-NAME",
           "arn:aws:s3:::S3-BUCKET-NAME/*"
       ]
   }

   Note: This statement allows the Hyperforce IAM role to replicate objects into the bucket. For more information, see Granting permissions when the source and destination buckets are owned by different AWS accounts(Link opens in a new window) at the AWS website.

   • Using "*" and "<path>/*" grants access to all prefixes in the specified bucket and path in the bucket.

   • The "s3:ReplicateObject" and "s3:ReplicateDelete" permissions are the minimum permissions required to successfully replicate objects and delete markers.

4. Optional. If your destination bucket has a policy that restricts access through an Amazon Virtual Private Cloud (VPC) endpoint, you must change the bucket policy in addition to the TableauS3ReplicationRoleAccess that you just added. For more information, see How do I allow only specific VPC endpoints or IP addresses to access my Amazon S3 bucket?(Link opens in a new window) at the AWS website.

   If the current bucket policy contains a VPC restriction like this:

   {
       "Sid": "Restricted VPC Access",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:*",
       "Resource": [
           "arn:aws:s3:::S3-BUCKET-NAME",
           "arn:aws:s3:::S3-BUCKET-NAME/*"
       ],
       "Condition": {
           "StringNotEquals": {
               "aws:SourceVpc": "vpc-<ID>"
           }
       }
   }

   Then edit the "Condition" list. Use the Role mapping by region table to find your region-specific role and role ID, and then replace HYPERFORCE-IAM-ROLE and HYPERFORCE-IAM-ROLE-ID.

   "StringNotLike": {
       "aws:userId": ["HYPERFORCE-IAM-ROLE-ID:*"]
   },
   "ArnNotLike": {
       "aws:PrincipalArn": "HYPERFORCE-IAM-ROLE"
   }

   The edited policy should look like this:

   {
       "Sid": "Restricted VPC Access",
       "Effect": "Deny",
       "Principal": "*",
       "Action": "s3:*",
       "Resource": [
           "arn:aws:s3:::S3-BUCKET-NAME",
           "arn:aws:s3:::S3-BUCKET-NAME/*"
       ],
       "Condition": {
           "StringNotLike": {
               "aws:userId": ["HYPERFORCE-IAM-ROLE-ID:*"]
           },
           "ArnNotLike": {
               "aws:PrincipalArn": "HYPERFORCE-IAM-ROLE"
           },
           "StringNotEquals": {
               "aws:SourceVpc": "vpc-<ID>"
           }
       }
   }

   This policy explicitly allows the Hyperforce IAM role to ReplicateObject and ReplicateDelete. It also excludes the role from the existing explicit VPC deny statement.

5. Click Save changes.

Verify security file replication

1. Go to the target Amazon S3 bucket and find the folder beginning with siteLuid (the remainder of the name is the site's unique identifier).

2. Find the text file named SECURITY_VERIFICATION_FILE.txt.

3. Download and open the text file.

4. Copy the text content inside the file.

5. Return to the Settings page and paste the text contents into the Text file contents input field, and then click Submit.

6. If the submitted content is correct, the connection status changes to Active. Activity Log is now enabled, and data will begin to replicate to the target Amazon S3 bucket.

7. If the submitted content is incorrect, an error message will be displayed. Check that the content was copied correctly without extra characters or spaces.

Troubleshooting

Security verification file not appearing?

• The file could take up to 15 minutes to appear in the target Amazon S3 bucket due to Amazon S3 limitations.

  If the connection status says "In progress", the file is still attempting to replicate. For more information, see Troubleshooting replication(Link opens in a new window) at the AWS website.

• A connection status of Failed means that the file was unable to replicate successfully.

  Confirm that the permissions on the Amazon S3 bucket policy and the AWS Key Management Service (KMS) key policy contain the appropriate statements. For more information, see the following topics at the AWS website:

  • Troubleshooting replication(Link opens in a new window)
  • Configuring replication when source and destination buckets are owned by different accounts(Link opens in a new window)
  • I set up replication between my buckets, but new objects aren't replicating. How can I troubleshoot this?(Link opens in a new window)

Other settings that are required for log files to reach the Amazon S3 bucket

• The Amazon S3 bucket has Bucket Versioning enabled (under Properties > Bucket Versioning).

• The Amazon S3 bucket has Block all public access enabled (under Permissions > Block public access (bucket settings)).

• The Amazon S3 bucket has the following ACL permissions for only "Bucket owner" (under Permissions > Access Control List (ACL)):

  • Objects: List, Write

  • Bucket ACL: Read, Write

• The KMS key permissions policy contains the statement in Step 2. Create an Amazon S3 bucket and set up permissions, step 2. i. (under Properties > Default encryption click on the ARN under AWS KMS Key ARN to go to the KMS key policy).

• The Amazon S3 bucket has default encryption enabled and bucket key enabled (under Properties > Default encryption).

• The Amazon S3 bucket permissions policy (under Permissions > Bucket Policy) exactly matches the one in the instructions. Ensure that you have replaced the example value "S3-BUCKET-NAME" with the Amazon S3 bucket you just created.

AWS region change for sites on Europe - Ireland pods

Between August 2024 to March 2025, Tableau Cloud sites were migrated to Salesforce's Hyperforce(Link opens in a new window). As part of the migration, pods in the Ireland region moved to the Germany region. If your site resided on a pod in the Ireland region, you'll need to reconfigure Activity Log to use an AWS S3 bucket in the new region, Germany.