AWS S3 Node
Store and retrieve files, manage buckets, and organize objects in AWS Simple Storage Service (S3).
tenants/{tenantId}/ prefix.
Resources & Operations (13 total)
bucket 4 Operations
bucket/create
Create a new S3 bucket with encryption, versioning, ACL, and public access block settings.
View documentation →bucket/delete
Permanently delete an empty S3 bucket. Optionally verify the bucket is empty before deletion.
View documentation →bucket/list-all
List all S3 buckets in the AWS account accessible to the configured IAM credentials.
View documentation →bucket/search
List objects in a bucket with optional prefix filter and cursor-based pagination.
View documentation →object 6 Operations
object/upload
Upload base64-encoded or plain-text content to S3 with storage class, encryption, ACL, and tagging support.
View documentation →object/download
Download an object from S3 to a local path. Supports versioned objects and byte-range requests.
View documentation →object/copy
Copy an object within or between S3 buckets server-side — no local download required.
View documentation →object/delete
Delete a specific object or object version. Supports governance retention bypass for locked objects.
View documentation →object/get-many
List objects in a bucket with optional prefix filtering and paginated results.
View documentation →object/exists
HEAD-probe whether an object exists — returns a boolean, never downloads the object body.
View documentation →folder 3 Operations
folder/create
Create a logical folder (zero-byte key ending in /) to organize objects by prefix.
folder/delete
Delete all objects matching a prefix — effectively removing a folder and all its contents.
View documentation →folder/get-many
List the contents of a folder prefix with optional pagination for large directories.
View documentation →Authentication & Connection
Operation nodes have no credential or region fields. Every S3 operation is wired to a connected S3 Server satellite node, which holds the vault credential (an ApiKey-type record — Username = access key ID, Password = secret key, with an optional STS session token via a secondary vault alias), the AWS region, and an optional Service URL endpoint override for S3-compatible backends. The satellite's values are merged onto every connected operation node at execution time. Full field reference: S3 Server (satellite).
s3:PutObject, s3:GetObject), restricted to specific bucket ARNs. Avoid attaching AmazonS3FullAccess to automation credentials.
Supported AWS Regions
Set on the connected S3 Server satellite. This exact list of 15 is enforced even when Service URL redirects to a non-AWS backend — see S3 Server (satellite) for why.
| Region ID | Location |
|---|---|
us-east-1 | US East (N. Virginia) |
us-east-2 | US East (Ohio) |
us-west-1 | US West (N. California) |
us-west-2 | US West (Oregon) |
ap-south-1 | Asia Pacific (Mumbai) |
ap-northeast-1 | Asia Pacific (Tokyo) |
ap-northeast-2 | Asia Pacific (Seoul) |
ap-southeast-1 | Asia Pacific (Singapore) |
ap-southeast-2 | Asia Pacific (Sydney) |
ca-central-1 | Canada (Central) |
eu-central-1 | Europe (Frankfurt) |
eu-west-1 | Europe (Ireland) |
eu-west-2 | Europe (London) |
eu-west-3 | Europe (Paris) |
sa-east-1 | South America (Sao Paulo) |
Storage Classes
Choose the right storage class to balance cost, availability, and retrieval speed for your use case.
| Storage Class | Best For | Retrieval | Cost Profile |
|---|---|---|---|
| STANDARD | Frequently accessed data, active workloads | Milliseconds | Highest storage; no retrieval fee |
| INTELLIGENT_TIERING | Unknown or changing access patterns | Milliseconds | Auto-tiers; small monitoring fee per object |
| STANDARD_IA | Infrequently accessed, rapid retrieval needed | Milliseconds | Lower storage; per-GB retrieval fee |
| ONE_ZONE_IA | Reproducible infrequent data, single-AZ OK | Milliseconds | ~20% less than STANDARD_IA; single AZ only |
| GLACIER | Long-term archive, retrieval in minutes to hours | 1 min – 12 hrs | Very low storage; retrieval fees apply |
| DEEP_ARCHIVE | Compliance archives, accessed <1x/year | 12 – 48 hrs | Lowest storage; highest retrieval fee |
Rate Limits & Performance
Node Policies & GuardRails
| Policy Area | Recommendation |
|---|---|
| Credential Storage | Store the access key ID / secret key pair in the BizFirst vault as an ApiKey record on the connected S3 Server satellite. Never hardcode credentials in workflow configuration or expression fields. |
| IAM Least-Privilege | Grant only the specific S3 actions the workflow needs, scoped to specific bucket ARNs. Avoid AmazonS3FullAccess. |
| Default ACL | Always default to private ACL. Never use public-read-write without an explicit, reviewed business requirement. |
| Encryption | Enable server-side encryption (AES256 minimum) for all buckets containing PII, financial data, or business-sensitive content. |
| Versioning | Enable versioning on critical data buckets before automating deletions. Versioning protects against accidental overwrites and provides point-in-time recovery. |
| Audit Trail | Log objectKey and eTag values in workflow execution context for a complete audit trail of all S3 operations. |
| Key Expression Safety | Use specific objectKey expressions — avoid expressions that could resolve to an unexpected key and overwrite or delete the wrong object. |
| Large File Uploads | object/upload automatically switches to a multipart PUT above 5 MB — no manual chunking or extra nodes needed. The upload payload is still capped by the connected satellite's maxUploadBytes (default 100 MB, up to 5 GB). |