Amazon S3

#What you need

S3 is available on Business plans and above. Create an S3 credential with:

• Access key ID and secret access key.
• Region and bucket name.
• Optional: a default prefix, a temporary session token, a custom endpoint URL and path-style addressing for S3-compatible storage.

#Least-privilege permissions

Use an IAM user or role scoped to the specific bucket and prefix, with only the actions a job needs:

s3:ListBucket      (on the bucket)
s3:GetObject       (read source)
s3:PutObject       (write destination)
s3:DeleteObject    (only for Move, Sync/Mirror, or Scheduled Purge)

Scope the policy to the prefix the job uses — a policy for reports/* won't allow exports/*.

#Set up and test

1. Create the credential under Credentials → New credential → Amazon S3.
2. Enter the access key, region, and bucket (plus any optional fields).
3. Choose Test connection before saving.

#Common mistakes

• Policy too narrow or wrong prefix. AccessDenied usually means the action or prefix isn't covered.
• Bucket policies / SCPs override IAM. An organization policy can deny even when the user allows.
• Wrong region. A mismatched region can surface as a connection error.

See S3 troubleshooting.