Configuration
The resource/operation model, connection settings, validation rules, and storage-class reference for all 13 S3 operations.
Resource / Operation Model
Every S3 node config selects one of 13 operations via a resource + operation pair — not a single flat operation string. There is no generic "S3 node" config; each combination has its own dedicated form with its own field set, documented on its own page:
| Resource | Operations |
|---|---|
bucket | create, delete, list-all, search |
object | upload, download, copy, delete, get-many, exists |
folder | create, delete, get-many |
Connection: Vault + Satellite
| Mode | When | What you provide |
|---|---|---|
| Vault credential (default) | Normal use, any environment | An ApiKey-type vault record on the satellite — Username = access key ID, Password = secret key |
| IAM role | Host runs on EC2/ECS/Lambda with a role attached | Nothing — set useIamRole=true on the satellite |
Full field reference, the 15-value region list, credential-format rules, and how to point this node at Backblaze B2/MinIO/Cloudflare R2/DigitalOcean Spaces: see S3 Server (satellite).
Validation Rules
| Field | Rule |
|---|---|
| Bucket name | 3–63 chars; lowercase letters, digits, hyphens, and dots only; must start/end with a letter or digit; no consecutive dots; must not start with xn--; must not end with -s3alias; must not look like an IPv4 address. |
| Object key / folder path / prefix | ≤ 1024 UTF-8 bytes; no NUL or control characters (tab excepted); no .. path-traversal segments. |
| Region | Must be one of the 15 fixed AWS region codes — see S3 Server (satellite). |
| KMS Key ID | Required, 8–2048 chars, whenever Server-Side Encryption is aws:kms. |
| Max Keys | 1–1000 (AWS's own hard ceiling on a single list/search page). |
Each rule maps to a specific error code — see Input & Output for the full error model.
Tenant Isolation
Every object key, folder path, and search prefix is automatically rewritten under tenants/{tenantId}/ before being sent to S3 — on 10 of the 13 operations (everything except bucket/create, bucket/delete, and bucket/list-all, which act on the bucket itself). See Input & Output for the full effectiveKey model.
Storage Classes
Available on object/upload via the storageClass field. Choose the right class to balance cost, availability, and retrieval speed.
| Storage Class | Best For | Retrieval | Cost Profile |
|---|---|---|---|
| STANDARD | Frequently accessed data, active workloads | Milliseconds | Highest storage; no retrieval fee |
| INTELLIGENT_TIERING | Unknown or changing access patterns | Milliseconds | Auto-tiers; small monitoring fee per object |
| STANDARD_IA | Infrequently accessed, rapid retrieval needed | Milliseconds | Lower storage; per-GB retrieval fee |
| ONE_ZONE_IA | Reproducible infrequent data, single-AZ OK | Milliseconds | ~20% less than STANDARD_IA; single AZ only |
| GLACIER | Long-term archive, retrieval in minutes to hours | 1 min – 12 hrs | Very low storage; retrieval fees apply |
| DEEP_ARCHIVE | Compliance archives, accessed <1x/year | 12 – 48 hrs | Lowest storage; highest retrieval fee |
MIME Type Reference
Use with object/upload's contentType field.
| File Type | Extension | Content-Type |
|---|---|---|
| PDF Document | application/pdf | |
| JSON Data | .json | application/json |
| CSV Spreadsheet | .csv | text/csv |
| Plain Text | .txt | text/plain |
| Markdown | .md | text/markdown |
| JPEG Image | .jpg / .jpeg | image/jpeg |
| PNG Image | .png | image/png |
| ZIP Archive | .zip | application/zip |
| Excel Workbook | .xlsx | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| Word Document | .docx | application/vnd.openxmlformats-officedocument.wordprocessingml.document |
| HTML File | .html | text/html |
| Binary / Unknown | various | application/octet-stream |
objectKey paths with meaningful segments to keep buckets organized at scale — e.g. {document_type}/{year}/{month}/{entity_id}/{filename}. Remember the tenant prefix is added automatically on top of whatever you type — see Input & Output.