Examples
Five worked workflow patterns using the real 13-operation resource/operation model.
Example 1 — Read-Only Connectivity Check
The fastest way to confirm a satellite's credential, region, and (if set) Service URL actually work before building anything real.
- Drop an S3 Server satellite node — vault credential, Region
us-east-1, Service URL blank (real AWS) or set (S3-compatible backend). - Wire into one bucket/list-all node.
- Run. Success returns
bucketNames(array). Failure → checkerrorCodeagainst the per-operation Validation Errors table.
Example 2 — Full Upload → Verify → Download → Delete Pipeline
A safe test order that never leaves orphaned resources if the workflow stops midway. Same shape whether the connected satellite targets real AWS or an S3-compatible backend.
- bucket/create — fresh bucket, all defaults (private, AES256, versioning off).
- folder/create —
folderPath: invoices/2026/. - object/upload —
objectKey: invoices/2026/hello.txt,dataMode: text, File Datahello world. - object/exists — same key, confirm
exists: truebefore trusting downstream reads. - object/download — same key.
- object/copy — duplicate to
invoices/2026/hello-copy.txt(same bucket). - object/delete — remove the copy.
- folder/delete —
folderPath: invoices/, clears the remaining original + folder marker. - bucket/delete — Verify Empty on (default) — destroys the now-empty bucket.
Example 3 — Chaining Download Straight Into Upload
Move an object between two buckets without object/copy — useful when a transform step needs to sit in between.
// Node: FetchSource (S3 — object/download)
{
"bucketName": "acme-ingest-landing",
"objectKey": "{{ $node.ListFiles.output.currentKey }}"
// downloadPath left blank — only the in-workflow bytes are needed
}
// Node: TransformFile (Code Execute) — optional processing step
// Node: WriteDestination (S3 — object/upload)
// Input Data Key stays at its default ("data") — reads FetchSource's raw
// bytes output directly. No re-encoding step, regardless of Data Mode.
{
"bucketName": "acme-processed-archive",
"objectKey": "processed/{{ $node.ListFiles.output.currentKey }}"
}
Example 4 — Paginating a Large Bucket
object/get-many (and bucket/search) cap at 1000 keys per call. To walk a bucket with more objects than that:
// First call: no continuationToken
{
"bucketName": "acme-archive",
"prefix": "reports/",
"maxKeys": 1000
}
// If nextContinuationToken is non-empty, loop back into the same node
// with that value in continuationToken. Stop when it comes back empty.
Example 5 — Wiring to Backblaze B2 Instead of AWS
Point the same operation nodes at a completely different, cheaper backend with zero changes to the operation nodes themselves — only the satellite changes.
| Satellite Field | Value |
|---|---|
| Vault credential | Secret type ApiKey, Username = B2 keyID, Password = B2 applicationKey |
| Region | us-east-1 (any value — signing-only) |
| Service URL | https://s3.us-east-005.backblazeb2.com (your bucket's real B2 endpoint) |
| Force Path Style | Checked |
Every operation node wired to that satellite now talks to B2 — same field values as every example above. Full walkthrough: S3 Server (satellite).
IAM Policy for a Minimal Upload + Read Workflow
For a workflow that only needs to upload and read back objects in one bucket, scope the vault credential's underlying IAM identity to just that:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:PutObject", "s3:GetObject"],
"Resource": "arn:aws:s3:::bizfirst-reports/*"
}
]
}
Do not grant s3:* or account-wide access. Scope permissions to the specific bucket and only the actions the workflow actually needs. This is an AWS IAM concern (attached to the credential itself, not visible to the node) — it does not apply when the connected satellite's Service URL points at a non-AWS backend, which has its own access-control model (e.g. B2's per-key bucket/file-prefix restrictions).
Pattern Summary
| Pattern | Operations Used | Notes |
|---|---|---|
| Connectivity check | bucket/list-all | No fields besides the connected satellite — first thing to run against any new credential/backend. |
| Safe write-then-read | upload → exists → download | Confirm a write landed before trusting a downstream read. |
| List and process | get-many / search → Loop → download | Check nextContinuationToken for buckets with >1000 objects. |
| Move without re-upload | copy → delete | Always copy first — verify success before deleting the source. |
| Zero-copy transform chain | download → upload | Raw bytes flow through the default Input Data Key with no re-encoding. |