AWS S3 Connection
The AWS S3 connection type enables automations to upload, download, list, and manage objects in Amazon S3 buckets (or S3-compatible storage services). It is used by the plugin-aws-s3 plugin, which delegates to the aws-s3-connector.
Connection Type
| Property | Value |
|---|---|
| Type enum | AWS |
| Type ID | aws |
| Category | Cloud |
| Entity class | AWSConnectionDetails |
The AWS connection type is shared across AWS services. When used with the S3 plugin, the connection provides general AWS credentials that the connector uses to build an S3 client. The specific AMAZON_S3 (amazon-s3) type ID also exists for S3-specific connections.
Friendly Example
| What you enter | Example |
|---|---|
| Connection name | AWS S3 - Report Storage |
| Used for | Uploading generated reports and downloading approved input files |
| Main details to collect | Access key, secret key, region, and bucket access details |
| Best person to provide it | AWS or cloud administrator |
After it is saved, workflow builders select AWS S3 - Report Storage in a node instead of entering these details again.
Mandatory Fields
| Field | Type | Required | Description |
|---|---|---|---|
accessKey | String | Yes | AWS Access Key ID for the IAM user or role. Encrypted at rest. |
secretKey | String | Yes | AWS Secret Access Key corresponding to the access key. Encrypted at rest. |
region | String | Yes | AWS region where the target S3 bucket resides (e.g., us-east-1, eu-west-1, ap-south-1). |
Advanced Fields
| Field | Type | Required | Description |
|---|---|---|---|
endpoint | String | No | Custom S3-compatible endpoint URL. Use this for MinIO, Wasabi, DigitalOcean Spaces, or other S3-compatible services (e.g., https://minio.internal:9000). |
pathStyleAccess | String | No | Set to true to use path-style access instead of virtual-hosted-style. Required for most S3-compatible services and some private endpoints. |
IAM Policy Requirements
The IAM user or role should only have the S3 permissions that the automation actually needs.
| Automation need | Permission to request from your AWS admin |
|---|---|
| Read files from a bucket | Allow list and read access for the target bucket |
| Upload generated files | Allow write access for the target bucket or folder |
| Delete files after processing | Allow delete access only if the workflow truly needs it |
| Use S3-compatible storage | Confirm the endpoint URL and path-style access setting |
For read-only automations, do not grant upload or delete access.
Setup Instructions
-
Create an IAM user in the AWS Console (IAM > Users > Create user).
- Select Programmatic access to generate an access key pair.
- Attach only the permissions needed for the automation.
-
Copy the Access Key ID and Secret Access Key from the creation confirmation page. The secret key is only shown once.
-
Identify the region of your target S3 bucket (visible in the S3 console bucket properties).
-
Create the connection in the Global Configurator with the credentials and region.
-
Test the connection to verify that the credentials can access the target bucket.
Avoid using root account credentials. Always create a dedicated IAM user with least-privilege permissions for automation use.
Troubleshooting
| Symptom | Likely Cause |
|---|---|
InvalidAccessKeyId | The accessKey does not exist or was deactivated in IAM |
SignatureDoesNotMatch | The secretKey is incorrect |
AccessDenied on a specific operation | The IAM policy does not grant the required action on the target resource |
NoSuchBucket | The bucket name is wrong, or the bucket is in a different region |
| Connection timeout to custom endpoint | The endpoint URL is unreachable, or a firewall is blocking the port |