Portal Community

Example 1 — Read-Only Connectivity Check

The fastest way to confirm a satellite's credential, region, and (if set) Service URL actually work before building anything real.

  1. Drop an S3 Server satellite node — vault credential, Region us-east-1, Service URL blank (real AWS) or set (S3-compatible backend).
  2. Wire into one bucket/list-all node.
  3. Run. Success returns bucketNames (array). Failure → check errorCode against the per-operation Validation Errors table.

Example 2 — Full Upload → Verify → Download → Delete Pipeline

A safe test order that never leaves orphaned resources if the workflow stops midway. Same shape whether the connected satellite targets real AWS or an S3-compatible backend.

  1. bucket/create — fresh bucket, all defaults (private, AES256, versioning off).
  2. folder/createfolderPath: invoices/2026/.
  3. object/uploadobjectKey: invoices/2026/hello.txt, dataMode: text, File Data hello world.
  4. object/exists — same key, confirm exists: true before trusting downstream reads.
  5. object/download — same key.
  6. object/copy — duplicate to invoices/2026/hello-copy.txt (same bucket).
  7. object/delete — remove the copy.
  8. folder/deletefolderPath: invoices/, clears the remaining original + folder marker.
  9. bucket/delete — Verify Empty on (default) — destroys the now-empty bucket.

Example 3 — Chaining Download Straight Into Upload

Move an object between two buckets without object/copy — useful when a transform step needs to sit in between.

// Node: FetchSource (S3 — object/download)
{
  "bucketName": "acme-ingest-landing",
  "objectKey": "{{ $node.ListFiles.output.currentKey }}"
  // downloadPath left blank — only the in-workflow bytes are needed
}
// Node: TransformFile (Code Execute) — optional processing step

// Node: WriteDestination (S3 — object/upload)
// Input Data Key stays at its default ("data") — reads FetchSource's raw
// bytes output directly. No re-encoding step, regardless of Data Mode.
{
  "bucketName": "acme-processed-archive",
  "objectKey": "processed/{{ $node.ListFiles.output.currentKey }}"
}

Example 4 — Paginating a Large Bucket

object/get-many (and bucket/search) cap at 1000 keys per call. To walk a bucket with more objects than that:

// First call: no continuationToken
{
  "bucketName": "acme-archive",
  "prefix": "reports/",
  "maxKeys": 1000
}
// If nextContinuationToken is non-empty, loop back into the same node
// with that value in continuationToken. Stop when it comes back empty.

Example 5 — Wiring to Backblaze B2 Instead of AWS

Point the same operation nodes at a completely different, cheaper backend with zero changes to the operation nodes themselves — only the satellite changes.

Satellite FieldValue
Vault credentialSecret type ApiKey, Username = B2 keyID, Password = B2 applicationKey
Regionus-east-1 (any value — signing-only)
Service URLhttps://s3.us-east-005.backblazeb2.com (your bucket's real B2 endpoint)
Force Path StyleChecked

Every operation node wired to that satellite now talks to B2 — same field values as every example above. Full walkthrough: S3 Server (satellite).

IAM Policy for a Minimal Upload + Read Workflow

For a workflow that only needs to upload and read back objects in one bucket, scope the vault credential's underlying IAM identity to just that:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject"],
      "Resource": "arn:aws:s3:::bizfirst-reports/*"
    }
  ]
}

Do not grant s3:* or account-wide access. Scope permissions to the specific bucket and only the actions the workflow actually needs. This is an AWS IAM concern (attached to the credential itself, not visible to the node) — it does not apply when the connected satellite's Service URL points at a non-AWS backend, which has its own access-control model (e.g. B2's per-key bucket/file-prefix restrictions).

Pattern Summary

PatternOperations UsedNotes
Connectivity checkbucket/list-allNo fields besides the connected satellite — first thing to run against any new credential/backend.
Safe write-then-readupload → exists → downloadConfirm a write landed before trusting a downstream read.
List and processget-many / search → Loop → downloadCheck nextContinuationToken for buckets with >1000 objects.
Move without re-uploadcopy → deleteAlways copy first — verify success before deleting the source.
Zero-copy transform chaindownload → uploadRaw bytes flow through the default Input Data Key with no re-encoding.