AWS S3 Credential - Cloud Storage

What is an AWS S3 Credential

An AWS S3 credential allows your workflows to upload, download, and manage files in Amazon S3 (Simple Storage Service). You need AWS IAM access credentials with S3 permissions.

---

Configuration Fields

Field	Description	Example
Access Key ID	Access key identifier	AKIAIOSFODNN7EXAMPLE
Secret Access Key	Secret access key	wJalrXUtnFEMI/K7MDENG/...
Region	AWS region where the bucket is located	us-east-1

---

How to Get the Credentials

Step 1: Create an IAM User

1. Go to console.aws.amazon.com/iam
2. In the sidebar, select Users > Create user
3. Name the user (e.g., “floogos-s3-access”)
4. Do not check the AWS console access option (you only need programmatic access)

Step 2: Assign S3 Permissions

1. In the permissions section, select Attach policies directly
2. Search and select one of these policies based on your needs:
   • AmazonS3FullAccess: Full access to all buckets (not recommended for production)
   • AmazonS3ReadOnlyAccess: Read only
3. For granular permissions, create a custom policy that limits access to specific buckets
4. Complete user creation

Step 3: Generate Access Keys

1. Select the created user and go to the Security credentials tab
2. In the Access keys section, click Create access key
3. Select the use case Application running outside AWS
4. Copy the Access Key ID and Secret Access Key immediately
5. The Secret Access Key won’t be shown again

Step 4: Identify the Region

1. Go to S3 in the AWS console
2. Locate your bucket and check the region (e.g., us-east-1, eu-west-1, sa-east-1)
3. If you don’t have a bucket, create one in the region closest to your users

---

Recommended Custom IAM Policy

For production, use a policy that limits access to a specific bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}

---

Troubleshooting

AccessDenied Error

• Verify the IAM user has the correct permissions for the operation
• Confirm the policy includes both the bucket and objects (/*)
• Check bucket policies that might be blocking access

Region Error

• Make sure you’re using the correct region where the bucket is located
• Regions are specified in us-east-1 format, not as full names

InvalidAccessKeyId

• Verify the Access Key ID is correct and has no spaces
• Confirm the access key hasn’t been deactivated or deleted

Bucket Not Found

• Check the exact bucket name (they are case-sensitive)
• Confirm the bucket exists in the specified region

---

Security

• Never use AWS root user credentials
• Create dedicated IAM users with minimum permissions
• Use custom policies that limit access to specific buckets
• Rotate access keys periodically (every 90 days recommended)
• Enable MFA on your AWS account
• Monitor access with AWS CloudTrail
• If credentials are compromised, deactivate them immediately in IAM