Guidewire Cloud Data Access Setup Guide Beta

Follow our setup guide to connect your Guidewire CDA S3 bucket to Fivetran.

Prerequisites

To connect Guidewire Cloud Data Access to Fivetran, you need:

Guidewire Cloud Data Access enabled and configured to export to an AWS S3 bucket
The path to your CDA application folder in the S3 bucket
An AWS account with an IAM role or access key that has s3:GetObject and s3:ListBucket permissions on the CDA bucket, unless you are using a public bucket.
(Optional) An Amazon S3 bucket, Azure Blob Storage container, or Google Cloud Storage bucket that you own to archive files from Guidewire's CDA bucket.

Setup instructions

Begin Fivetran configuration

In the connection setup form, enter the Destination schema of your choice.
In the Destination names field, choose the naming convention you want Fivetran to use for the schemas, tables, and columns in your destination:
- Fivetran naming: Standardizes the schema, table, and column names in your destination according to the Fivetran naming conventions.
- Source naming: Preserves the original column names from the source system in your destination. The source naming rules apply only to the column names, while the schema and table names follow the Fivetran naming rules.
If you want to modify your selection, make sure you do it before you start the initial sync.
Enter your S3 Bucket name. The Guidewire CDA writes its exports to this bucket.
If you are using an access point, enter the Access Point alias if you already have it or create one using our Configure access point instructions.
In the Access approach drop-down menu, select one of the following options:
- IAM Role (most secure): Give Fivetran access by creating an IAM role using our External ID.
- Access Key and Secret: Provide Fivetran an access key and secret for your S3 bucket. You may need to use this method if you don't own the bucket and its access methods are limited.
- Public Bucket: Give Fivetran access through a public bucket. Your AWS account does not need special permissions to sync public buckets. Skip to the Finish Fivetran configuration step.

You can use the Access Analyzer for S3 to find out if your S3 bucket has public or shared access.

Create IAM policy

You must create an IAM policy for both the IAM Role and Access Key and Secret approaches.

For encrypted buckets, follow Amazon S3 bucket instructions to modify the AWS KMS key's policy to grant Fivetran permissions to download files from your encrypted bucket.

Open your Amazon IAM console.
Go to Policies, then click Create Policy.
Go to the JSON tab.

Copy the following policy and paste it into the visual editor. Replace {your-bucket-name} with the name of your S3 bucket. After that, click Next: Tags.

{
    "Version": "2012-10-17",
    "Statement": [
        {
        "Effect": "Allow",
        "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket"

        ],
        "Resource": [
                "arn:aws:s3:::{your-bucket-name}/*",
                "arn:aws:s3:::{your-bucket-name}"
        ]
        }
    ]
}

(Optional) If you use a customer-managed KMS key, add the following policy to the Action section of the IAM policy to provide read access to the encrypted files.
```
     "Action": [
         "kms:Decrypt",
         "kms:GenerateDataKey"
     ]     
```
In the Add tags step, you can optionally add custom tags that will be associated with your bucket. Click Next: Review.
In the Review policy step, specify the name of your policy, for example "Fivetran-S3-Access", then click Create policy.

(Optional) Access using IAM role

Find External ID

In the connection setup form, find the automatically-generated External ID and make a note of it. You will need it to create an IAM role in AWS.

The automatically-generated External ID is tied to your account. If you close and re-open the setup form, the ID will remain the same. You can keep the tab open in the background while you configure your source for convenience.

Create IAM role

Go to Roles, then click Create role.
Select AWS account, then enter Fivetran’s AWS VPC Account ID, 834469178297, in the Account ID field.
Select the Require external ID checkbox and enter the External ID you found above, then click Next.
In the Add permissions step, select the "Fivetran-S3-Access" policy you created, then click Next.
In the Name, review, and create step, specify the role name, for example "Fivetran", then click Create role at the bottom of the page.
Click the Fivetran role you created.
On the Summary page for the role, find the ARN and make a note of it. You will need it to configure Fivetran.

If you want to re-use an existing IAM role created for Fivetran account, you need to edit the trust policy for the same role. You can then add another external ID to the JSON policy or copy the following policy and paste it in your JSON tab:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "AWS" : "arn:aws:iam::834469178297:user/gcp_donkey"  
                },
                "Action": "sts:AssumeRole",
                "Condition": {
                    "StringEquals": {
                        "sts:ExternalId": [
                            "external-id-1",
                            "external-id-2"
                        ]
                    }
                }
            }
        ]
    }

(Optional) Set permissions

You can specify permissions for the Role ARN that you designate for Fivetran. Giving selective permissions to this role will allow Fivetran to only sync the CDA objects it has permissions to read.

Skip to the Configure AWS PrivateLink step.

(Optional) Access using key and secret

You can skip this step if you already have an access key and secret.

Create user

You can skip this step if you already have a user having access to the bucket.

Open your Amazon IAM console.
Go to Users, then click Add users.
Enter the User name, then click Next.
Select the Attach policies directly option, then select the "Fivetran-S3-Access" policy you created.
Click Next, then click Create user.

Generate access key and secret

In the Users tab, open the User you created.
Go to Security credentials tab and navigate to the Access keys section.
Click Create access key.
From the Use Case options, select the Third-party service option and then click Next.
Enter a Description tag value and then click Create access key.
Copy the Access key and Secret access key values. You will need them to configure Fivetran.

(Optional) Configure AWS PrivateLink

You must have a Business Critical plan to use AWS PrivateLink.

AWS PrivateLink allows VPCs and AWS-hosted or on-premises services to communicate with one another without exposing traffic to the public internet. PrivateLink is the most secure connection method. Learn more in AWS PrivateLink documentation.

Follow our AWS PrivateLink setup guide to configure PrivateLink for your CDA S3 bucket.

There are two ways in which you can provide Fivetran access to your CDA data: using IAM policies to control access to S3 buckets (recommended) or using access points.

By default, you cannot configure PrivateLink if you want to use the Hybrid Deployment model. However, if you want to configure PrivateLink with Hybrid Deployment, see the Gateway endpoints for Amazon S3 documentation. With a gateway endpoint, you can access Amazon S3 from your VPC without an internet gateway or NAT device for your VPC.

(Optional) Configure access point

Create access point

Create an access point to provide Fivetran access to your CDA S3 bucket.
Open your S3 console.
On the left navigation pane, click Access Points.
Select the access point.
Go to the Properties tab. Make a note of the Access Point alias. You will need it to configure Fivetran.

To provide your bucket access to the access point, copy the following into the bucket policy you created. Replace {account-number} with your AWS account number, {role-name} with the role name that you created, {your-bucket-name} with the S3 bucket name that you used to configure the access point, {access-point-region} with the AWS region in which you created the access point, and {your-access-point} with the name of the access point you created.

{
 "Version": "2012-10-17",
 "Statement": [
    {
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::{account-number}:role/{role-name}"
        },
        "Action": [
            "s3:GetObject",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::{your-bucket-name}",
            "arn:aws:s3:::{your-bucket-name}/*"
        ],
        "Condition": {
            "StringLike": {
                "s3:DataAccessPointArn": "arn:aws:s3:{access-point-region}:{account-number}:accesspoint/{your-access-point}"
            }
        }
    }
]
}

Create an IAM policy for access point

Create a new access point policy. Copy the following policy and paste it in the JSON tab. Replace {access-point-region} with the region in which you created the access point, {account-number} with your account number, and {your-access-point} with the name of the access point you created.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                 "s3:GetObject",
                 "s3:ListBucket"
            ],
            "Resource": [
                 "arn:aws:s3:{access-point-region}:{account-number}:accesspoint/{your-access-point}",
                 "arn:aws:s3:{access-point-region}:{account-number}:accesspoint/{your-access-point}/*"
            ]
        }
    ]
}

(Optional) Configure an archive bucket

Perform this step only if you want to archive your CDA data.

Guidewire CDA retains data for a configured period of up to 180 days. To retain a copy of your CDA data for long-term storage and historical re-syncs, set the Enable archive bucket toggle to ON. Fivetran uses the archived data to re-sync historical records that are no longer available in the CDA bucket. We support the following storage services for archiving your CDA data:

Amazon S3
Azure Blob Storage
Google Cloud Storage

Follow the instructions for your selected storage service to configure the archive bucket.

Fivetran cannot write to the Guidewire CDA bucket because Guidewire does not allow write access. Use a separate bucket or container that you own to archive your CDA data.

Configure Amazon S3 archive bucket

Find archive external ID

In the connection setup form, set Enable archive bucket toggle to ON.
In the Archive bucket drop-down menu, select Amazon S3.
Find the automatically-generated External ID and make a note of it. You will need it to configure an IAM role in AWS.

Create IAM policy for the archive bucket

To allow Fivetran access to your archive S3 bucket, follow the instructions below.

Open your Amazon IAM console.
On the navigation menu click Policies > Create policy.
Go to the JSON tab.

Copy the following policy and paste it into the visual editor. Replace {archive-bucket-name} with the name of your archive S3 bucket.

{
 "Version": "2012-10-17",
 "Statement": [
     {
     "Effect": "Allow",
     "Action": [
             "s3:GetBucketLocation",
             "s3:ListBucket"
     ],
     "Resource": "arn:aws:s3:::{archive-bucket-name}"
     },
     {
     "Effect": "Allow",
     "Action": [
             "s3:GetObject",
             "s3:PutObject"
     ],
     "Resource": "arn:aws:s3:::{archive-bucket-name}/*"
     }
 ]
 }

Click Next: Tags.
Click Review Policy.
In the Review policy step, enter a Policy name. For example, enter "Fivetran-Guidewire-Archive-Policy".
Click Create Policy.

Create IAM role for the archive bucket

On the navigation menu click Roles > Create role.
On the Select trusted entity page, do the following:
- In the Trusted entity type section, select AWS account.
- Select the Another AWS account.
- In the Account ID field, enter Fivetran's AWS VPC Account ID, 834469178297.
- Select the Require external ID checkbox and enter the External ID you found.
Click Next.
In the Add permissions step, select the "Fivetran-Guidewire-Archive-Policy" policy you created, then click Next.
In the Name, review, and create step, enter the Role name and then click Create role. For example, "Fivetran-Guidewire-Archive".
Select the role you created.
On the Summary page for the role, make a note of the ARN. You will need it to configure Fivetran.

Configure Azure Blob Storage archive container

In the connection setup form, set Enable archive bucket toggle to ON.
In the Archive bucket drop-down menu, select Azure Blob Storage.

Follow the steps below to configure your container.

Register your app

Open the Azure Portal and go to Microsoft Entra ID.
On the navigation menu, click App registrations.
Click New registration.
Enter a name for your application, choose the supported account types, and register the application.
On the navigation menu, click Overview and make a note of the Application (client) ID and Directory (tenant) ID. You will need them to configure Fivetran.
On the navigation menu, click Manage > Certificates & secrets.
On the Certificates & secrets page, click New client secret.
Enter a description for your client secret, choose an expiration period, then click Add. Make a note of the client secret, you will need it to configure Fivetran.

Grant IAM access

Go to Azure Portal, navigate to Storage Accounts, select your storage account. Make a note of the Storage account name, you will need it to configure Fivetran.
Go to Storage browser > Blob containers, and select the container you want Fivetran to use for the archive. Make a note of the Blob container name, you will need it to configure Fivetran.
Go to Access Control (IAM), and in the top navigation pane, click + Add > Add role assignment.
In the search bar, search for Storage Blob Data Reader and Storage Blob Data Contributor, and click Next.
In the Members tab, select User, group, or service principal, and then click Next.
In the Select members dialog, search for the App that you created and then click Select.
Click Review + assign.

Configure Google Cloud Storage archive bucket

Find email

In the connection setup form, set Enable archive bucket toggle to ON.
In Archive bucket drop-down menu, select Google Cloud Storage.
Find the automatically-generated email GCS Bucket and make a note of it. You will need it to edit your Google Cloud Storage bucket permissions.

Authorize service account

Go to your Google Cloud Storage console.
On the navigation menu, click Buckets, then select the bucket you want to use for the archive.
Go to Permissions tab and click Grant access.
In the Grant access window, enter the New principals that you found.
In the Role drop-down menu, select Storage Object Admin.
Click Save.

Find bucket name

Go back to the main Google Cloud Storage Console.
Find the name of your bucket and make a note of it. You will need it to configure Fivetran.

Make sure you don't have any lifecycle management policies configured on your archive bucket or container.

Finish Fivetran configuration

Depending on your Access approach, do the following:
- If you selected IAM Role, enter the Role ARN you created for the CDA bucket.
- If you selected Access Key and Secret, enter the Access Key ID and Access Key Secret for the CDA bucket.
In the Application path field, enter the path of your CDA application folder relative to the bucket root.
Do not include the deployment timestamp folder in this field. Fivetran automatically identifies the active deployment and follows it when Guidewire redeploys CDA. For example, if your deployments are at s3://my-bucket/dev/cc/, enter dev/cc.
If you want to retain a copy of your CDA data in your storage resource, set the Enable archive bucket toggle to ON.
i. In the Archive bucket drop-down menu, select your own storage resource:
- If you select Amazon S3, enter the following details:
  - S3 bucket name
  - Role ARN you created
  The External ID is read-only. Use it in the archive role's trust policy.
- If you select Azure Blob Storage, enter the following details:
  - Container name and Storage account you created
  - Tenant ID, Client ID, and Client secret you created.
- If you select Google Cloud Storage, enter the GCS Bucket you found.
ii. (Optional) In the Prefix field, enter the folder path in your archive bucket where you want to store your files.
If you leave this field blank, Fivetran uses the root of the bucket or container as the folder path.
(Not applicable to Hybrid Deployment) If you want to connect using AWS PrivateLink, set the Require PrivateLink toggle to ON.
By default, we use PrivateLink to connect if your S3 bucket and destination are in the same region. Enabling this option ensures that we always use PrivateLink to connect. If the regions are different, Fivetran won't create the connection.
(Hybrid Deployment only) If your destination is configured for Hybrid Deployment, the Hybrid Deployment Agent associated with your destination is pre-selected for the connection. To assign a different agent, click Replace agent, select the agent you want to use, and click Use Agent.
Click Save & Test. Fivetran validates the S3 bucket, reads the manifest.json file in your latest deployment, and syncs the CDA-generated Parquet files referenced by the manifest.

Setup tests

Fivetran performs the following Amazon S3 connection tests:

The Validating Bucket Name test validates the bucket name you specified in the setup form and checks the bucket name to ensure that it does not contain any prefix or folder path characters.
The Reading CDA Manifest test validates that your Guidewire deployment is active and validates that the manifest.json file in your latest deployment is accessible.
The Validating External ID test validates if the external ID you specified in the setup form is correctly assigned and checks whether you have configured a security role using the external ID. We perform this test only if you select IAM Role in the Access approach field.
The Validating archive bucket connection test validates that Fivetran can list, write, and read files in your archive bucket or container, using the credentials you specified for the archive. We perform this test only if you set Enable archive bucket to ON.