AWS S3

Supported Operations

Key Capabilities

• Flexible data input — upload base64-encoded binary (PDFs, images, archives) or raw text and JSON
• Pre-signed URL generation — share files securely with external users for a configurable window (seconds to days)
• Custom metadata — attach key-value metadata to uploaded objects for later retrieval and cataloguing
• ACL control — set object access to private, public-read, or authenticated-read per upload
• Prefix-based listing — list objects in a virtual folder (prefix) to enumerate workflow outputs or archives
• Cross-bucket copy — copy objects between buckets, including across AWS regions
• Versioning aware — returns version IDs when bucket versioning is enabled
• IAM credential management — credentials stored securely in BizFirst Credentials Manager

Business Benefits

Store Generated Documents

After a workflow generates a PDF invoice, contract, or report, upload it directly to S3 with a structured key path (e.g. invoices/2026/05/INV-00421.pdf). The returned object_url can be stored in a database record and included in email notifications — giving recipients a permanent link to the document.

Distribute Files via Pre-Signed Links

Generate time-limited download URLs for sensitive files without making objects publicly accessible. Send the URL by email or webhook. When the URL expires the file is no longer accessible — enforcing download windows for compliance and data security requirements.

ETL Intermediate Storage

In multi-step data processing workflows, store intermediate results between transformation stages. S3 acts as a reliable, scalable handoff layer between workflow branches — avoiding timeouts from passing large datasets through workflow variables.

Workflow Output Archiving

Archive every workflow execution's output (exports, summaries, processed records) to a dated S3 folder for audit retention. Use the list operation with a date prefix to enumerate archived runs and the download operation to retrieve any past output on demand.

Customer Document Upload

Generate a PUT pre-signed URL for an S3 key, return it to the customer via a webhook or API response, and the customer uploads directly to S3 without the file passing through your workflow servers. This enables large-file upload support at scale.

Use Cases at a Glance

In This Guide

S3 Key Naming Conventions

S3 has no real folders — keys are flat strings with slashes used as visual delimiters. Consistent key naming is critical for listing, lifecycle policies, and operational clarity at scale.

Security Best Practices

• Always use acl: private for business documents — never public-read
• Use pre-signed URLs with the shortest appropriate expiry for sharing files externally
• Enable S3 bucket versioning for important document buckets to protect against accidental deletion
• Enable server-side encryption (SSE-S3 or SSE-KMS) on buckets storing sensitive data
• Use separate IAM roles with least-privilege policies per workflow type
• Enable S3 access logging on production buckets for audit trails
• Use S3 Object Lock for regulatory compliance archiving (WORM storage)
• Configure S3 Lifecycle rules to automatically transition old objects to Glacier for cost savings

Credential Setup

Store AWS credentials in BizFirst Credentials Manager with the following fields:

Lifecycle Management Recommendations

Use S3 Lifecycle rules (configured directly in AWS, not in BizFirst) to automatically manage object retention and cost:

These rules reduce storage costs significantly on large-scale deployments without any workflow code changes — S3 applies them automatically on a daily basis.