AWS Import/Export
Developer Guide

Create Your First Amazon S3 Export Job

An Amazon S3 export transfers individual objects from Amazon S3 buckets owned by your AWS account to your device, creating one file for each object. You can export from more than one bucket and you can specify which files to export using manifest file options.

AWS Import/Export requires encryption with all export jobs. You must either provide a PIN-code protected device with hardware encryption or instruct AWS to encrypt the device using TrueCrypt software encryption with a password that you supply. If you provide a PIN-code protected device, you can optionally specify TrueCrypt encryption in addition.

For added security for your data while the device is in transit, AWS Import/Export formats your device before beginning the data load. Any data that is stored on the device when you sent the device to AWS will be lost. AWS copies your data to an encrypted file container on your device. If you specify software encryption, you will need to decrypt the data using TrueCrypt encryption software. For more information, see Encrypting Your Data.


If you lose your password or device PIN code, you will not be able to decrypt your device. AWS will not provide your password or PIN code if you lose them.

You must submit a separate job request for each device.


You can send multiple devices in the same shipment. If you do, however, there are specific guidelines and limitations that govern what devices you can ship and how your devices must be packaged. If your shipment is not prepared and packed correctly, AWS Import/Export cannot process your jobs. Regardless of how many devices you ship at one time, you must submit a separate job request for each device. For complete details about packaging requirements when shipping multiple devices, see Shipping Multiple Devices.

For more information, see Guidelines and Limitations


Export from Amazon EBS to a storage device is not currently supported.


You can create a bucket using the AWS Management Console. For more information, see Creating a Bucket.

To create an Amazon S3 export job

  1. Configure your Amazon S3 buckets.

  2. Create a manifest file.

  3. Prepare your device for shipping.

  4. Send a CreateJob request.

    AWS Import/Export sends a response with a SIGNATURE file and job information.

  5. Copy the SIGNATURE file to your device.

  6. Ship your device.

These steps assume that you have signed up for an AWS account and created your file as described in the earlier tasks.

Configure Your Amazon S3 Buckets

Before you create your export job, make sure that the Amazon S3 buckets that you're exporting data from are properly configured by doing the following.

Set Lifecycle Management Configuration

With Amazon S3, you can manage the lifecycle of objects in an Amazon S3 bucket. You can schedule objects for archival in Amazon Glacier, or to be deleted on an expiration date. For more information about Amazon S3 lifecycle configurations, see Object Lifecycle Management in the Amazon Simple Storage Service Developer Guide.

With AWS Import/Export Disk, you can export data only from Amazon S3. This constraint is important if you have Amazon S3 lifecycle configuration rules in place to move data from Amazon S3 into Amazon Glacier. In this case, you should make sure that the lifecycle rules don't move the Amazon S3 objects and buckets that you want to export into Amazon Glacier before your export job is completed. Data that was moved into Amazon Glacier by these lifecycle rules before the Disk job finishes exporting isn't exported to your disk.

Disable Requester Pays

Before you create your export job, make sure that the Requester Pays property is disabled on the buckets you're exporting data from. If you don’t do this, any export jobs created for Requester Pays buckets fail. For more information on how to do this in the Amazon S3 Management Console, see Configure Requester Pays by Using the Amazon S3 Console in the Amazon Simple Storage Service Developer Guide.

Create a Manifest File

The manifest file is a YAML-formatted text file that instructs AWS about how to handle your job. It consists of a set of name-value pairs that supply required information such as your device ID, log bucket, return address, and so on. For more information about YAML, go to

The AWS Import/Export Web Service Tool provides three examples of manifest files that you can modify for your import and export jobs.

  1. Go to the Examples folder in the folder where you installed the AWS Import/Export Web Service Tool.

  2. Open the S3-export-manifest.txt file in a text editor.

    manifestVersion:2.0 generator:text editor deviceId:[Enter device serial number] fileSystem:[NTFS| EXT4] pinCode: [PIN code] trueCryptPassword: [password] serviceLevel:expeditedShipping targetDirectory:/ recoveryDirectory:EXPORT-RECOVERY logBucket:[Your log bucket] notificationEmail: [Email addresses, semicolon separated] operations: - exportBucket:[Your bucket] returnAddress: name:[Your name] company:[Optional - your company] street1:[Your street] street2:[Optional - additional street info] street3:[Optional - additional street info] city:[Your city] stateOrProvince:[Required for USA and Canada. Your state or province.] postalCode:[Your postal code] country:[Your country] phoneNumber:[Contact number]


    When shipping devices internationally except within the European Union you must include the customs option in the manifest. For more information about the customs-related manifest options, see Customs Manifest File Option.

  3. In the file, replace all text in brackets with the appropriate values. Delete any unused optional lines.

  4. Provide a device PIN code or an encryption password. AWS uses the PIN code or password you provide to encrypt your data. You will need the same PIN code or password to decrypt your data after you receive the data back from AWS. If you do not provide a PIN code or password in your manifest, the CreateJob request will fail.

  5. Provide the name of the existing Amazon S3 bucket containing the data to export, a bucket name to save your log data. For the logBucket and exportBucket options provide only the name of the bucket, for example s3examplebucket.


    For export, your Amazon S3 log bucket and your Amazon S3 export bucket must be in the same region. If your buckets are in different regions, your job request will fail.

  6. Save the file as MyS3ExportManifest.txt in the same folder as your file.

For more information about manifest file options, see Creating Export Manifests .

Send a CreateJob Request

Now that you have your credentials file and manifest file in place, you send a CreateJob request to AWS Import/Export. You send a separate CreateJob request for each device.

  1. Open a command prompt (or, on a Mac, use the Terminal application), and change to the directory where you unzipped the AWS Import/Export tool.

  2. Enter the following CreateJob request on the command line.

    cmdPrompt>java -jar lib/AWSImportExportWebServiceTool-1.0.jar CreateJob Export MyS3ExportManifest.txt .

    The CreateJob request includes a directory name for where you want the SIGNATURE file saved. In this example, the closing period (.) at the end of the command refers to the current directory. Either include the period, as shown above, or replace it with a directory path.

If there is an error, AWS Import/Export returns an error message.

If there are no errors in the request, AWS Import/Export returns a JOB CREATED response. The following is a sample response.

JOB CREATED JobId: TC44P JobType: Export **************************************** * AwsShippingAddress * **************************************** Please call GetShippingLabel API to retrieve shipping address **************************************** * SignatureFileContents * **************************************** version:2.0 signingMethod:HmacSHA1 jobId:TC44P signature:BBAqQ/E+R7bdXRVR1s9vTi5t7Aps= Writing SignatureFileContents to C:\ImportExportWebServiceTool\.\SIGNATURE

Your job expires after 30 days. If you do not send a device, there is no charge.

After your job is created, the Amazon S3 bucket policy for the bucket that you specified at job creation will automatically be updated with the temporary permissions necessary to export the data to your device from Amazon S3. For more information, see Automatic Resource Policy Updates.

Copy the Signature File

In response to your CreateJob request, AWS writes a file named SIGNATURE to your computer. The SIGNATURE file contains a signature, which is an encrypted string that allows us to authenticate your device and match it to your job request.

Locate the SIGNATURE file in the directory that you specified in your job request and copy it to the root directory of your storage device. The file name must be named SIGNATURE and it must be in the device's root directory.

Each device you send must include the unique SIGNATURE file for that device and that JOBID. AWS Import/Export validates the SIGNATURE file on your storage device before starting the data load. If the SIGNATURE file is missing or invalid (for example, if it is associated with a different job request), AWS Import/Export will not perform the data load and we will return your storage device.

Send a GetShippingLabel Request

Generate, print out, and attach your pre-paid shipping label through the AWS Import/Export Web Service Tool's GetShippingLabel action. For detailed instructions, see Generating Your Pre-Paid Shipping Label.

Ship Your Device

It is essential that you prepare your device properly before shipping. If your device is not properly prepared for shipping and export, AWS might need to erase the device and return it without processing the request. If we are unable to erase the data on the device, we will schedule it for destruction and our support team will contact you using the email address specified in the manifest file. For more information, see Shipping Your Storage Device.

  1. Pack the power supply, power cable, and interface cables with your storage device. Without these, we can't transfer your data and will return your device.

  2. Generate, print out, and attach your pre-paid shipping label.

    For detailed instructions for preparing and shipping your device, see Shipping Your Storage Device.

  3. Arrange for UPS to pick up your package by calling them directly or take your package to a UPS package drop off facility to be shipped to AWS. You will not have to pay UPS for the shipping charges but AWS will add these charges to the fee charged for processing your device. If you are shipping internationally, see International Considerations for Mailing Your Storage Device.


Your job expires after 30 days. If you do not send a device, there is no charge. You are billed only after AWS Import/Export receives your device. If we receive your package after your job expires, we will return your device. You will only be charged for the shipping fees, if any.

Now, you have explored the getting started steps of AWS Import/Export. To learn more about the product, see Where Do I Go from Here?.