# S3 Data Lake Destination Config Reference

<p><a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/" >S3 Data Lake</a> is a data lake destination. RudderStack writes events as Parquet files into an S3 bucket on a schedule, and can register their schema in the AWS Glue Data Catalog so you can query them with Athena.</p>
<p>In an S3 Data Lake destination spec:</p>
<ul>
<li><code>type: s3_datalake</code></li>
<li><code>definition_version: 1</code></li>
</ul>
<!-- end-chunk -->
<!-- begin-chunk -->
<h2 id="sample-configuration">Sample configuration</h2><div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">version: rudder/v1
kind: destination
metadata:
  name: s3-datalake-prod
spec:
  id: s3-datalake-prod
  display_name: S3 Data Lake Production
  type: s3_datalake
  definition_version: 1
  enabled: true
  config:
    bucket_name: acme-datalake-prod
    prefix: rudder
    namespace: web_events
    enable_sse: false
    cleanup_object_storage_files: false

    use_glue: true
    region: us-east-1
    time_window_layout: dt=2006-01-02

    role_based_auth: true
    iam_role_arn: &#34;arn:aws:iam::123456789012:role/RudderStackDatalake&#34;

    sync_frequency: &#34;180&#34;
    sync_start_at: &#34;01:00&#34;

    skip_users_table: true
    skip_tracks_table: false

    underscore_divide_numbers: false
    allow_users_context_traits: false

    connection_mode:
      web: cloud
      cloud: cloud
    consent_management:
      web:
        - provider: oneTrust
          consents:
            - analytics</code></pre></div>
</div>
<p>The above example registers the schema on AWS Glue with date-only partitions, and uses role-based authentication, so it carries no access keys — see <a href="#aws-glue" >AWS Glue</a> and <a href="#authentication" >Authentication</a>.</p>
<!-- end-chunk -->
<!-- begin-chunk -->
<h2 id="config-keys">Config keys</h2><p><code>config</code> accepts only the keys listed below. The <a href="https://www.rudderstack.com/docs/dev-tools/rudder-cli/destination-types/#config-key-rules" >shared config key rules</a> cover unknown keys, defaults, and immutability.</p>
<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="storage">Storage</h3><p>RudderStack writes each table to <code>s3://&lt;bucket_name&gt;/&lt;prefix&gt;/rudder-datalake/&lt;namespace&gt;/&lt;table&gt;/</code>. See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/#find-data-in-s3-data-lake" >Find data in S3 data lake</a>.</p>
<div class="rs-ckeys">
<div class="rs-ckey" id="bucket_name">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">bucket_name</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Name of the S3 bucket RudderStack writes the data lake into. The bucket must already exist.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>3 to 63 characters: lowercase letters, digits, dots, and hyphens, starting and ending with a letter or digit.</li>
<li>Must not start with <code>xn--</code>, contain consecutive dots, or look like an IPv4 address.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="prefix">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">prefix</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Folder prefix inside the bucket, placed before <code>rudder-datalake/</code>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Not validated locally.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="namespace">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">namespace</p>Immutable</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Folder under <code>rudder-datalake/</code> that holds this destination&rsquo;s tables. When <code>use_glue</code> is <code>true</code>, it&rsquo;s also the name of the Glue database RudderStack creates the table definitions in. Defaults to the source name when omitted.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>At most 64 characters, and must not start with <code>pg_</code> in any capitalization.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
<li>Can&rsquo;t be changed once the destination exists — the API rejects the update. Create a new destination instead.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="enable_sse">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">enable_sse</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Enable server-side encryption on the files RudderStack writes.
</p>

</div>

<div class="rs-ckey" id="cleanup_object_storage_files">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">cleanup_object_storage_files</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Delete intermediate object storage files after a sync completes successfully.
</p>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="aws-glue">AWS Glue</h3><div class="rs-ckeys">
<div class="rs-ckey" id="use_glue">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">use_glue</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Register each table&rsquo;s schema in the AWS Glue Data Catalog, so you can query the data lake without running a crawler. This is what the dashboard calls <strong>Register schema on AWS Glue</strong>.
</p>

<div class="rs-ckey__extra">
  The IAM role or user needs Glue permissions, plus Lake Formation permissions if your account uses them. See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/#connection-settings" >Connection settings</a> and <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/#aws-lake-formation-permissions" >AWS Lake Formation permissions</a>.
</div>

</div>

<div class="rs-ckey" id="region">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">region</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  AWS region of the Glue Data Catalog — for example <code>us-east-1</code>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Required when <code>use_glue</code> is <code>true</code>. Leave it unset otherwise.</li>
<li>Not validated beyond being present.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="time_window_layout">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">time_window_layout</p>Immutable</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Partition layout of the folders under each table, written as a Go time layout.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Applies when <code>use_glue</code> is <code>true</code>. Leave it unset otherwise.</li>
<li>Omit it, or set <code>&quot;&quot;</code>, for hourly folders — <code>YYYY/MM/DD/HH</code>.</li>
<li>Set <code>dt=2006-01-02</code> for daily Hive-style folders — <code>dt=YYYY-MM-DD</code>.</li>
<li>Not validated locally. Those two values are the ones the dashboard offers.</li>
<li>Can&rsquo;t be changed once the destination exists — the API rejects the update.</li>
</ul>

</div>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="authentication">Authentication</h3><p><code>role_based_auth</code> selects the authentication method, and decides which of the remaining three keys are required.</p>

<blockquote class="warning">
  <div class="tip-quote">
    
    <div class="tip-text"><p>Rudder CLI checks only that the keys the selected method needs are present. It doesn&rsquo;t reject the keys belonging to the other method, so a spec carrying both an <code>iam_role_arn</code> and an access key pair passes <code>validate</code> and applies.</p>
<p>Leave the unused method&rsquo;s keys out — otherwise you store credentials the destination never reads.</p>
</div>
  </div>
</blockquote>
<div class="rs-ckeys">
<div class="rs-ckey" id="role_based_auth">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">role_based_auth</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Whether to authenticate with an IAM role. Set it to <code>true</code> to use <code>iam_role_arn</code>, or <code>false</code> to use the access key pair.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>The dashboard defaults this field to <code>true</code>. Rudder CLI requires it explicitly.</li>
<li>A spec that omits this key fails validation with <code>'role_based_auth' is required</code>.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="iam_role_arn">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">iam_role_arn</p>Required</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  ARN of the IAM role RudderStack assumes to write to the bucket.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Required when <code>role_based_auth</code> is <code>true</code>. Leave it unset otherwise.</li>
<li>At most 100 characters, and must not contain line breaks.</li>
<li>A <code>{{ path || fallback }}</code> template is accepted in place of a literal.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/#option-1-use-rudderstack-iam-role" >Option 1: Use RudderStack IAM role</a>.
</div>

</div>

<div class="rs-ckey" id="access_key_id">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">access_key_id</p>RequiredSecret</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  AWS access key ID authorizing RudderStack to write to the bucket.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Required when <code>role_based_auth</code> is <code>false</code>. Leave it unset otherwise.</li>
<li>Must not be empty or contain line breaks. There&rsquo;s no upper length limit.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  Supply it as a <code>{{ .VAR }}</code> reference rather than a literal — see <a href="#secrets" >Secrets</a>.
</div>

</div>

<div class="rs-ckey" id="access_key">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">access_key</p>RequiredSecret</div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  AWS secret access key matching <code>access_key_id</code>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Required when <code>role_based_auth</code> is <code>false</code>. Leave it unset otherwise.</li>
<li>Must not be empty or contain line breaks. There&rsquo;s no upper length limit.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  See <a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/#option-2-create-iam-user-and-provide-credentials" >Option 2: Create IAM user and provide credentials</a>.
</div>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="sync-scheduling">Sync scheduling</h3><div class="rs-ckeys">
<div class="rs-ckey" id="sync_frequency">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">sync_frequency</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>180</code>
  </p>
<p class="rs-ckey__field">
  Description:
  How often RudderStack syncs staged events into the data lake, in minutes. Written as a string, not a number.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>One of <code>5</code>, <code>10</code>, <code>15</code>, <code>30</code>, <code>60</code>, <code>180</code>, <code>360</code>, <code>720</code>, or <code>1440</code>.</li>
<li>Optional here, unlike on the other warehouse destinations, where Rudder CLI requires it.</li>
</ul>

</div>

</div>

<div class="rs-ckey" id="sync_start_at">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">sync_start_at</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>string</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Time of day, in UTC, that anchors the sync schedule. Subsequent syncs are computed from it at <code>sync_frequency</code> intervals. Written as <code>HH:MM</code>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>Not validated locally: any string is accepted, and a value the scheduler can&rsquo;t parse silently yields no scheduled times.</li>
</ul>

</div>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="table-behavior">Table behavior</h3><div class="rs-ckeys">
<div class="rs-ckey" id="skip_users_table">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">skip_users_table</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>true</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Send <code>identify</code> events only to the <code>identifies</code> table, skipping the <code>users</code> table. The <code>users</code> table holds one row per unique user and is maintained with a merge, which can add significant time to each sync.
</p>

</div>

<div class="rs-ckey" id="skip_tracks_table">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">skip_tracks_table</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Skip sending events to the <code>tracks</code> table. Per-event tables are unaffected.
</p>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="legacy-column-naming">Legacy column naming</h3><p>Both keys below preserve the column naming of destinations created before the behavior changed. Leave them at their defaults on a new destination. Neither can be changed once the destination exists — the API rejects the update.</p>
<div class="rs-ckeys">
<div class="rs-ckey" id="underscore_divide_numbers">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">underscore_divide_numbers</p>ImmutableInternal</div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  When <code>false</code>, numeric suffixes in column names are preserved: <code>v3</code> stays <code>v3</code> rather than being split into <code>v_3</code>.
</p>

</div>

<div class="rs-ckey" id="allow_users_context_traits">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">allow_users_context_traits</p>ImmutableInternal</div>
  <p class="rs-ckey__field">
    Type:
    <code>boolean</code>
  </p><p class="rs-ckey__field">
    Default value:
    <code>false</code>
  </p>
<p class="rs-ckey__field">
  Description:
  When <code>false</code>, <code>context.traits.*</code> fields aren&rsquo;t promoted to top-level traits and are stored only as <code>context_traits_*</code> columns.
</p>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h3 id="per-source-keys">Per-source keys</h3><p>Both keys are objects keyed by the local source type — the tokens listed under <a href="#source-types" >Source types</a>. A key naming a source type this destination doesn&rsquo;t support fails validation.</p>
<div class="rs-ckeys">
<div class="rs-ckey" id="connection_mode">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">connection_mode</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>object</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Maps each source type you connect to the mode its events reach the data lake in, using the modes in <a href="#source-types" >Source types</a>.
</p>

<div class="rs-ckey__notes">
  <p class="rs-ckey__field">Notes:</p>
  <ul>
<li>An entry is required for each source type you connect — see <a href="#connect-a-source" >Connect a source</a>.</li>
</ul>

</div>

<div class="rs-ckey__extra">
  <div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">connection_mode:
  web: cloud
  cloud: cloud</code></pre></div>
</div>

</div>

</div>

<div class="rs-ckey" id="consent_management">
  <div class="rs-ckey__title">
    <p class="rs-ckey__name">consent_management</p></div>
  <p class="rs-ckey__field">
    Type:
    <code>object</code>
  </p>
<p class="rs-ckey__field">
  Description:
  Consent provider configuration per source type. The entry shape, accepted providers, and the rules on <code>resolution_strategy</code> and <code>consents</code> are shared across all destination types — see <a href="https://www.rudderstack.com/docs/dev-tools/rudder-cli/destination-types/#consent-management" >Consent management</a>.
</p>

</div>

</div>

<!-- end-chunk -->
<!-- begin-chunk -->
<h2 id="source-types">Source types</h2><p>S3 Data Lake accepts events from these source types in the mentioned connection modes:</p>
<table>
<thead>
<tr>
<th>Source type</th>
<th>Connection mode</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>android</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>android_kotlin</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>ios</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>ios_swift</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>web</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>unity</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>cloud</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>react_native</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>flutter</code></td>
<td><code>cloud</code></td>
</tr>
<tr>
<td><code>cordova</code></td>
<td><code>cloud</code></td>
</tr>
</tbody>
</table>
<p>Every source type is <code>cloud</code> only — events reach the bucket from RudderStack&rsquo;s servers, never in device mode.</p>

<html lang="en">
<blockquote class="info">
  <div class="tip-quote">
    
    <div class="tip-text">The dashboard additionally offers S3 Data Lake to AMP, Shopify, and cloud app sources. Rudder CLI doesn&rsquo;t manage those connections, so <code>amp</code>, <code>shopify</code>, and <code>cloud_source</code> are invalid here.</div>
  </div>
</blockquote>

</html>
<!-- end-chunk -->
<!-- begin-chunk -->
<h2 id="connect-a-source">Connect a source</h2><p>An event stream connection to this destination is checked against two rules at <code>validate</code> time.</p>
<p><strong>The source&rsquo;s type must be supported.</strong> A source&rsquo;s type resolves to one of the tokens above before the check — a JavaScript source resolves to <code>web</code>, and webhook and server-side SDK sources resolve to <code>cloud</code>. An unsupported type reports:</p>
<div class="rs-code">
  <div class="rs-code__head"><button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-text" data-lang="text">destination &#39;s3-datalake-prod&#39; (type &#39;s3_datalake&#39;) does not support source &#39;my-source&#39;:
source type &#39;amp&#39; is not among supported source types: android, android_kotlin, ...</code></pre></div>
</div>
<p><strong>The destination config must carry a <code>connection_mode</code> entry for that source type.</strong> This lives on the destination spec, not on the <a href="https://www.rudderstack.com/docs/dev-tools/rudder-cli/yaml-connections/" >connection spec</a>. Without it:</p>
<div class="rs-code">
  <div class="rs-code__head"><button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-text" data-lang="text">destination &#39;s3-datalake-prod&#39; config has no &#39;connection_mode&#39; entry for source type &#39;web&#39;</code></pre></div>
</div>
<p>S3 Data Lake needs no additional config keys to connect a source of any type.</p>
<!-- end-chunk -->
<!-- begin-chunk -->
<h2 id="secrets">Secrets</h2><p><code>access_key_id</code> and <code>access_key</code> are the secret keys, and apply only when <code>role_based_auth</code> is <code>false</code>. Write each as a <code>{{ .VAR }}</code> reference and supply the value at apply time:</p>
<div class="rs-code">
  <div class="rs-code__head">yaml<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-yaml" data-lang="yaml">config:
  bucket_name: acme-datalake-prod
  role_based_auth: false
  access_key_id: &#34;{{ .AWS_ACCESS_KEY_ID }}&#34;
  access_key: &#34;{{ .AWS_SECRET_ACCESS_KEY }}&#34;</code></pre></div>
</div>
<div class="rs-code">
  <div class="rs-code__head">bash<button class="rs-code__copy" type="button">
      
      Copy
    </button>
  </div>
  <div class="highlight"><pre class="chroma"><code class="language-bash" data-lang="bash">export RUDDER_AWS_ACCESS_KEY_ID=&#34;AKIAIOSFODNN7EXAMPLE&#34;
export RUDDER_AWS_SECRET_ACCESS_KEY=&#34;wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY&#34;
rudder-cli apply

# or
rudder-cli apply --var-file secrets.vars.yaml</code></pre></div>
</div>
<p>Note that:</p>
<ul>
<li>A <code>{{ .VAR }}</code> reference satisfies the requirement check, so a spec using access keys validates before the values are supplied.</li>
<li>The YAML that <code>rudder-cli import</code> writes may or may not include secret keys. Before you apply, make sure every secret key your configuration needs is present and populated through variable substitution.</li>
<li><code>iam_role_arn</code> isn&rsquo;t a secret — an ARN identifies a role but grants nothing on its own.</li>
</ul>
<p>See <a href="https://www.rudderstack.com/docs/dev-tools/rudder-cli/variable-substitution/" >How to Use Variable Substitution in Rudder CLI</a>.</p>
<!-- end-chunk -->
<!-- begin-chunk -->
<h2 id="see-more">See more</h2><ul>
<li><a href="https://www.rudderstack.com/docs/destinations/warehouse-destinations/s3-datalake/" >S3 Data Lake Destination</a> for bucket permissions, Glue crawlers, and querying with Athena</li>
<li><a href="https://www.rudderstack.com/docs/dev-tools/rudder-cli/destination-types/" >Destination Type Reference for Rudder CLI</a> for the rules shared across destination types</li>
<li><a href="https://www.rudderstack.com/docs/dev-tools/rudder-cli/yaml-destinations/" >Destination YAML Reference</a> for the spec envelope</li>
</ul>