Step 1: Set Up Your Account

Setting up your Amazon Web Services (AWS) account is a one-time process. After you complete these steps, you can upload catalog files without repeating the setup.

1. Sign in to your AWS account

To upload your catalog file to Amazon Simple Storage Service (S3), you must have an AWS account.

If you already have an AWS account, sign in at aws.amazon.com.

To create a new account

1. Go to aws.amazon.com.
2. Choose Create an AWS Account.
3. Follow the prompts to create your account.

2. Provide details to set up your account

To set up your account, provide the following details to your Amazon representative:

• Account ID – Send the 12-digit AWS account ID to your Amazon representative by using a secure method. Amazon needs this ID to grant your account access to the S3 catalog folder.

  Note: Your AWS account ID is different from an access key ID or secret access key. Those are specific to Identity and Access Management (IAM) users.

  Find your AWS account ID by using one of following methods:

  • Root account users: Sign in to the AWS Management Console. Your account ID appears in the upper corner under your account name, or on the Security Credentials page under Account Identifiers.
  • IAM or federated users: Your account ID appears in the Support Center in the upper corner.

  • AWS CLI: Use the following command.

    aws sts get-caller-identity --query Account --output text
    

• List of devices to allow list – Provide a list of Fire TV device serial numbers (DSNs) to enable for testing. After you submit your catalog the staging environment, you can use the allow listed device to verify your content is discoverable.
• Email address – The ingestion system sends emails for both successes and failures. If you want to receive one or both types of emails, ask your Amazon representative to include you on both lists. Use a team or group email address (for example, catalog-team@company.com) instead of personal emails. This allows multiple stakeholders to receive important ingestion notification and makes sure your team receives continuous communication even if team members change.

3. Receive your access configuration

After you send your AWS account ID, your Amazon representative provides the following information:

• Your provider prefix – Identifies your catalog within the shared S3 bucket amazon-media-catalogs. For example, if your provider prefix is acme-streaming, your catalog files live under s3://amazon-media-catalogs/acme-streaming/.
• An IAM role Amazon Resource Name (ARN) – You assume this role to obtain temporary credentials for uploading catalog files. The role ARN looks like: arn:aws:iam::123456789012:role/CatalogUploadRole.
• Session tag support – The IAM role supports both sts:AssumeRole and sts:TagSession permissions. You can pass optional session tags when assuming the role for audit tracking and organizing access logs.

4. Set up AWS CLI and configure role assumption

This step covers installing the CLI, configuring your credentials, and assuming the IAM role for catalog uploads.

Install the AWS CLI

If you don't have the AWS CLI installed, follow the instructions at Installing or updating to the latest version of the AWS CLI in the AWS documentation.

Configure your own AWS credentials

To set up your base credentials, run aws configure. You will see the following prompts.

AWS Access Key ID [None]: AAAAAAAAAAAAAEXAMPLE
AWS Secret Access Key [None]: aAaaaAAaaAAA/A1AAAAA/aAaAaaAAEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: json

These are your own IAM user credentials, not the catalog upload credentials.

Assume the IAM role for catalog upload

To upload catalog files, you must assume the IAM role that your Amazon representative provided. This gives you temporary credentials scoped to your S3 catalog bucket.

aws sts assume-role \
  --role-arn <role-arn-from-your-rep> \
  --role-session-name catalog-upload \
  --tags Key=<tag-key>,Value=<tag-value>

The response contains temporary credentials as shown in this example.

{
  "Credentials": {
    "AccessKeyId": "ASIAEXAMPLEKEYID",
    "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "SessionToken": "FwoGZXIvYXdzEBYaDH...",
    "Expiration": "2025-04-20T18:00:00Z"
  }
}

Export the credentials as environment variables.

export AWS_ACCESS_KEY_ID=ASIAEXAMPLEKEYID
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_SESSION_TOKEN=FwoGZXIvYXdzEBYaDH...

Optional: Configure a named CLI profile

For convenience, you can configure a named profile in ~/.aws/config that automatically handles role assumption, as shown here.

[profile catalog-upload]
role_arn = <role-arn-from-your-rep>
source_profile = default
region = us-east-1
# Note: AWS CLI named profiles don't support session tags.
# Use the aws sts assume-role --tags command directly,
# or use the AWS SDK (for example, Python boto3) for automated uploads.

After you add the profile in your config file, you can use --profile catalog-upload with any AWS CLI command.

aws s3 cp my-catalog.xml.zst s3://amazon-media-catalogs/<provider>/staging/catalogs/ \
  --profile catalog-upload

5. Test your access

To verify that your credentials work, upload a test file.

aws s3 cp test.txt s3://amazon-media-catalogs/<provider>/staging/catalogs/test.txt

If successful, you see output with the following format.

upload: ./test.txt to s3://amazon-media-catalogs/<provider>/staging/catalogs/test.txt

If you encounter issues, use the following table to troubleshoot.

Clean up your test file after verifying access by using the following command.

aws s3 rm s3://amazon-media-catalogs/<provider>/staging/catalogs/test.txt

• Previous – EMBER Catalog Integration Overview
• Next – Step 2: Upload Your Catalog to Staging

Last updated: May 27, 2026