Export Data to Amazon S3

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to an Amazon S3 bucket using one-click Workload Identity Federation, manual WIF, or an access key.

Export your Mondoo security data to an Amazon S3 bucket for long-term retention, custom reporting, or integration with an AWS data pipeline. For how exports work in general, read Continuous Data Exports.

Requirements

An AWS account with an S3 bucket. See the Amazon S3 documentation for setup.
Editor or Owner access to the Mondoo space from which you want to export data.
Permission in AWS to create IAM roles and, for Workload Identity Federation, IAM identity providers.

Choose an authentication method

Mondoo can authenticate to AWS in three ways:

One-click Workload Identity Federation (WIF) (recommended): Keyless. You give Mondoo your AWS account ID, and Mondoo hands you a ready-to-run aws CLI script that creates the OIDC provider and the export role in your account. Nothing to rotate, and no values to copy back into Mondoo.
Manual WIF: Also keyless, but you create the OIDC provider and IAM role yourself, then paste the audience and role ARN into Mondoo. Use this path when your organization requires specific resource names, or when the Mondoo OIDC provider already exists.
Access key: A static IAM access key ID and secret access key. Simplest to set up, but you're responsible for securely storing and regularly rotating the key.

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo presents a short-lived OIDC token to AWS STS through AssumeRoleWithWebIdentity, and AWS issues temporary credentials for a role that can write to your bucket. No static keys are stored or transmitted.

In the one-click flow, Mondoo generates the setup script for you. The script creates:

Resource	Name
IAM OIDC provider	Your Mondoo STS issuer host
Export role	`mondoo-s3-export`
Inline role policy	`mondoo-s3-export` (write access to the target bucket)

The role's trust policy is pinned to this integration's subject and audience, and the inline policy grants only s3:PutObject on the target bucket plus s3:ListBucket on the bucket itself.

The script is safe to run more than once. If the role already exists, the script refreshes its trust policy instead of failing.

Step 1: Create the Amazon S3 export integration in Mondoo

In the Mondoo App, navigate to the space from which you want to export data. In the side navigation, select Integrations. Under Exports, select Amazon S3.
In the Choose an integration name box, enter a name for the integration.
Under Define the export destination, fill in:
- Bucket name. The S3 bucket name.
- Region. The bucket's region ID. Mondoo also uses this region to open AWS CloudShell in the next step.
- Export as. JSONL or CSV.
Under Configure authentication, select the Workload Identity Federation (recommended) tab.
In the AWS account ID box, enter the 12-digit ID of the AWS account that owns the bucket.
Select Generate setup.

Mondoo creates the integration and shows you the setup script. No data is exported yet.

Step 2: Run the setup script in AWS

Select Open AWS CloudShell. CloudShell opens in a new tab, in the region you chose.
Copy the script from Mondoo, paste it into CloudShell, and press Enter.
Wait for the script to print Mondoo AWS S3 export setup complete.

Make sure you're signed in to the same AWS account whose ID you entered in Mondoo. You can also run the script from any workstation with the AWS CLI installed and authenticated to that account.

Step 3: Run the first export

Return to the Mondoo tab and select Run first export.

New IAM permissions can take a minute to propagate. If the first export fails with a permissions error, wait a moment and try again.

Step 4: Verify the integration

On the integration details page, wait for the export to complete. If the status becomes active, the setup is working correctly. Exports then run automatically approximately every 24 hours.

If the export fails, double-check:

The setup script finished successfully in the same AWS account whose ID you entered in Mondoo.
The bucket name and region are correct.
The mondoo-s3-export role exists and its inline policy names your bucket.

Manage this integration

After it's created, find your integration under Integrations in your space's side navigation. Select it to open the detail page, where you can:

Trigger a manual export. Exports run automatically about every 24 hours. To export immediately, select SCHEDULE NOW.
Check the status. active means the integration is healthy and exporting on schedule. pending means Mondoo hasn't attempted the first export yet. error means the last export failed.
Remove the integration. Select the trash can icon and confirm. Mondoo stops future exports but does not delete data that has already been exported.