Step 1: Create an IAM Role in your AWS account

1. Open the IAM Console in your AWS account
2. Go to Roles → Create role
3. Select "Another AWS account" as the trusted entity
4. Enter Kita's AWS Account ID: 159906127457 Copy
5. Check "Require external ID" and enter: bd8c7153-c90a-42ab-8bc8-8fe1a046661f Copy
6. Click Next (skip attaching policies for now, we'll add inline)
7. Name the role (e.g., KitaS3ReadAccess) and create it

Step 2: Attach an S3 read policy

Open the role you just created and add this inline policy (replace YOUR-BUCKET-NAME with your actual bucket):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-BUCKET-NAME",
        "arn:aws:s3:::YOUR-BUCKET-NAME/*"
      ]
    }
  ]
}

Step 3: Copy the Role ARN

1. On the role summary page, copy the ARN (looks like arn:aws:iam::123456789012:role/KitaS3ReadAccess)
2. Paste it into the IAM Role ARN field below
3. Fill in your Bucket name and optional prefix, then click Preview