bucket/list-all FormID 20502
List all S3 buckets in the AWS account accessible to the configured credentials.
Account-Level Operation: This operation uses
s3:ListAllMyBuckets and returns every bucket the IAM identity can enumerate. It does not accept any filters — use bucket/search to list objects within a specific bucket.
When to Use
- Compliance audit: Enumerate all buckets in the account during a scheduled compliance review to verify naming conventions, expected encryption settings, and absence of orphaned buckets.
- Environment health check: Verify that all expected buckets exist (dev, staging, prod) as part of a deployment health check workflow.
- Backup reporting: List all buckets at the start of a backup summary report, then iterate with
bucket/searchto check object counts per bucket. - Admin UI population: Populate a bucket picker dropdown in an admin interface by fetching the live list of available buckets.
- Orphan detection: Cross-reference bucket list against tenant records to identify storage buckets no longer associated with active tenants.
Configuration
Connection
Credentials and region are not fields on this operation. Wire an S3 Server satellite node into this node's input. The satellite holds the vault credential (
ApiKey type — Username = access key ID, Password = secret key), the target AWS region, and an optional Service URL override for S3-compatible backends. Its values are merged onto this node at execution time and take precedence over anything set locally. See S3 Server (satellite) for the full field reference. Note: this call enumerates buckets in whichever single endpoint the satellite targets — it does not aggregate across regions or across multiple accounts/backends.
Operation Fields
No additional fields — this operation only needs the connected satellite's credential.
Sample Configuration
// Credentials + region resolved from the connected S3 Server satellite — see s3-server-satellite.html
{
"resource": "bucket",
"operation": "list-all"
}Validation Errors
| Error Code | Cause & Resolution |
|---|---|
AccessDenied | The IAM identity lacks s3:ListAllMyBuckets. Add this action to the IAM policy — it cannot be scoped to a specific resource, so grant at the * resource level. |
InvalidClientTokenId | The accessKeyId is invalid or has been deactivated. Verify the credential in the Credentials Manager and rotate if necessary. |
SignatureDoesNotMatch | The secretKey does not match the accessKeyId. Update the credential pair in the Credentials Manager. |
Output
Success Port
| Field | Type | Description |
|---|---|---|
status | string | success on successful enumeration. |
errorCode | string | Empty string on success. |
bucketCount | int | Total number of buckets returned. |
bucketNames | array | Array of bucket name strings, e.g. ["bucket-a", "bucket-b", "bucket-c"]. Loop nodes can iterate this directly — no split step needed. |
Error Port
On failure, activates with errorCode, errorMessage, and httpStatusCode. An AccessDenied error here indicates a missing s3:ListAllMyBuckets permission — this is an account-level permission that cannot be resource-scoped.
Sample Output
{
"status": "success",
"errorCode": "",
"bucketCount": 5,
"bucketNames": ["acme-prod-documents", "acme-staging-documents", "acme-dev-documents", "acme-compliance-archive-2026-Q2", "ci-artifacts-shared"]
}Expression Reference
| Expression | Result |
|---|---|
{{ $node.ListBuckets.output.bucketCount }} | Total bucket count — use in report generation or health check assertions. |
{{ $node.ListBuckets.output.bucketNames }} | Array of bucket names — iterate directly in a Loop node, or join for an audit report body. |
{{ $node.ListBuckets.output.status }} | Confirm success before processing the list in downstream nodes. |
Node Policies & GuardRails
| Policy Area | Recommendation |
|---|---|
| Credential Storage | Store credentials in BizFirst Credentials Manager. Never hardcode. |
| IAM Permissions | Grant s3:ListAllMyBuckets on resource * — this is the minimum required. Do not grant additional write permissions to audit-only credentials. |
| Read-Only Audit Credentials | Use a dedicated read-only IAM user for compliance and audit workflows. Separate from credentials used for write operations. |
| Scheduled Audit Frequency | Run compliance bucket listing on a schedule (weekly or monthly) rather than on every workflow execution to reduce unnecessary API calls. |
| Output Handling | The bucketNames output is already an array — wire it directly into a Loop node for iteration workflows, no split/transform step required. |
| Cross-Account Awareness | Credentials only return buckets accessible to that IAM identity. For multi-account setups, use separate credential sets per account and aggregate results downstream. |
| Sensitive Output | Bucket names may reveal organizational structure. Treat the output as sensitive — do not expose in public-facing logs or notifications. |
Examples
Example 1: Weekly Compliance Audit
A scheduled workflow lists all buckets and sends the count and names to a compliance review Slack channel.
// Node: ListAllBuckets (S3 — bucket/list-all)
// Node: FormatReport (Code Execute)
// Output: "Bucket count: 5 | Names: acme-prod-documents, ..."
// Node: NotifyCompliance (Slack — message/send)Example 2: Environment Health Check
Assert that the three expected environment buckets are present before a deployment proceeds.
// Node: ListBuckets (S3 — bucket/list-all)
// Node: CheckBucketsPresent (If Condition)
// Condition: bucketNames includes "myapp-prod-assets"
// AND bucketNames includes "myapp-staging-assets"
// AND bucketNames includes "myapp-dev-assets"
// True path: Proceed with deployment
// False path: Abort and alert DevOps teamExample 3: Orphaned Bucket Detection
A monthly workflow cross-references the live bucket list with the tenant database to find buckets no longer linked to active tenants.
// Node: ListBuckets (S3 — bucket/list-all)
// Node: GetActiveTenantBuckets (Database query → array of expected bucket names)
// Node: FindOrphans (Code Execute)
// Logic: compare bucketNames (array) against active tenant bucket list
// Node: AlertOpsTeam with orphaned bucket names for review