AWS S3 Connection

Connect to Amazon S3 to manage objects (files) in your buckets.

Configuration

Field	Description	Required
Access Key ID	AWS IAM access key ID	Yes
Secret Access Key	AWS IAM secret access key	Yes
Region	AWS region (e.g., us-east-1)	Yes
Custom Endpoint	Override the S3 endpoint URL	No

Custom Endpoint is only needed when connecting to S3-compatible services instead of AWS S3. Leave it empty for standard AWS S3. Examples of S3-compatible services and their endpoints:

Service	Endpoint Format
MinIO	http://localhost:9000 (or your MinIO server URL)
DigitalOcean Spaces	https://{region}.digitaloceanspaces.com
Cloudflare R2	https://{account_id}.r2.cloudflarestorage.com
Backblaze B2	https://s3.{region}.backblazeb2.com

Getting Your Credentials

Step 1: Create an IAM User

1. Log in to the AWS Console
2. Go to IAM > Users > Create user
3. Enter a username (e.g., workflow-automation-s3)
4. Click Next

Step 2: Set Permissions

On the Set permissions page, choose Attach policies directly and attach one of the following:

Policy	Access Level	Use When
AmazonS3FullAccess	Full read/write to all buckets	Quick setup, testing, or when workflows need broad S3 access
AmazonS3ReadOnlyAccess	Read-only to all buckets	Workflows only list and download objects
Custom policy	Scoped to specific buckets/actions	Production use — recommended for least-privilege access

Custom policy example — scoped to a single bucket

Replace my-bucket with your actual bucket name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::my-bucket"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

To use a custom policy: click Create policy, switch to the JSON tab, paste the policy above, save it, then return to the user creation flow and attach it.

Step 3: Create Access Key

1. After creating the user, go to the user's detail page
2. Click the Security credentials tab
3. Under Access keys, click Create access key
4. For use case, select Third-party service
5. Check the acknowledgment checkbox and click Next
6. Click Create access key
7. Copy both the Access Key ID and Secret Access Key — the secret is only shown once

Step 4: Create an S3 Bucket

If you don't already have a bucket, create one:

1. Go to the S3 Console
2. Click Create bucket
3. Enter a Bucket name — must be globally unique (e.g., mycompany-workflow-data)
4. Select the AWS Region — use the same region you'll enter in the connection settings
5. Leave Object Ownership as default (ACLs disabled)
6. Under Block Public Access settings, keep Block all public access checked (recommended)
7. Leave the remaining options as default and click Create bucket

WARNING

The Region you select when creating the bucket must match the Region you configure in the connection settings, otherwise requests will fail.

Usage

Once created, this connection becomes available in:

• S3 List Objects — list objects in a bucket
• S3 Download — download objects
• S3 Upload — upload objects
• S3 Delete — delete objects

TIP

Never use your AWS root account credentials. Always create a dedicated IAM user with only the permissions your workflows need.