Relevant BI integration with Amazon Web Services

Defense in depth, not a single security switch

A security-focused integration layer separates transport encryption, identity, authorization, storage protection, and monitoring. AWS supplies building blocks for these layers; application owners must configure them and maintain the surrounding processes. A connector should receive only the permissions required for its specific source and destination, rather than broad access to an entire account or reporting environment.

• Scope IAM permissions to specific resources and required actions
• Prefer temporary workload credentials where supported
• Separate connector identities and customer data boundaries
• Review permissions, retention, and access revocation over time

SFTP: encrypted file transport with explicit trust

SFTP runs over SSH, rather than transmitting files through unencrypted FTP. AWS Transfer Family supports managed SFTP endpoints and connectors for file exchange. A reviewed design verifies the remote server's host key, scopes user access to the appropriate destination, and manages authentication keys through a defined lifecycle. Transport encryption does not by itself protect a file after it reaches storage: storage encryption, key permissions, retention, and application authorization require separate decisions.

• Validate file type, size, schema, and source before importing
• Quarantine malformed or unexpected payloads instead of silently loading them
• Consider S3 encryption and AWS KMS key policies for stored files
• Record transfer outcomes and make retry behavior explicit

SMTP: protect submission and understand delivery limits

For email submission, Amazon SES provides an SMTP interface with TLS support and region-specific SMTP credentials. A security-focused configuration requires an encrypted connection and stores credentials outside source code and browser bundles. TLS on the submission connection is not the same as end-to-end message encryption. Delivery to a recipient's mail server has its own TLS policy and compatibility considerations; sensitive data should not be placed in an email merely because SMTP submission uses TLS.

• Use SES SMTP credentials appropriate to the selected AWS Region
• Require TLS for submission and review outbound TLS requirements
• Configure SPF, DKIM, and DMARC for domain authentication—not message encryption
• Monitor delivery failures and avoid logging sensitive message content

Custom customer connectors: narrow access, validated inputs

A custom connector may need an API credential, scheduled file import, or customer-specific transformation. The security review should define exactly what it can read, where it can write, and how failures are contained. AWS Secrets Manager can store connector secrets; rotation requires support and configuration for the particular credential. IAM roles, network restrictions, request validation, rate limits, and controlled retries can reduce exposure when implemented correctly. None replaces validation of the external system itself.

• Validate schemas and reject unexpected fields before downstream processing
• Use idempotent imports to prevent duplicate records during retries
• Restrict network access where the selected services support it
• Keep credentials and sensitive payloads out of diagnostic logs

From external data to understandable cross-source reports

The value is not simply moving a file or sending an email. An authorized external dataset can add context to the sources already enabled in Relevant BI. For example, a scheduled customer-provided export can be reviewed alongside GA4 engagement and Google Ads spend once its fields, dates, and identifiers are mapped. SMTP supports delivery or notifications; it is not itself evidence of a lead or a sale. Retaining source labels and refresh timestamps helps teams distinguish current observations from delayed imports and avoid treating correlation as complete attribution.

Auditability and the shared responsibility boundary

AWS CloudTrail can record supported API activity, while service logs and CloudWatch can support operational visibility where configured. Coverage, retention, access to logs, and alert routing must be deliberately chosen; an audit trail is only useful if the relevant events are captured and reviewed. AWS secures its underlying cloud infrastructure, while customers remain responsible for their data, permissions, application code, and service configuration. AWS certifications do not automatically certify Relevant BI or an individual connector.