S3 — S3 Server (satellite)

Why a satellite node? None of the 13 bucket/object/folder operation nodes have accessKeyId/secretKey/region fields. Connection settings live in one place — this satellite node — and are merged onto every operation node wired to it via property merge. This keeps a workflow with many S3 operations from needing the same credential and region set repeatedly, and lets one workflow point different S3 nodes at different backends simply by connecting different satellites.

How It Works

Drop one S3 Server satellite node on the canvas.
Pick a vault credential on the satellite's header (accepted type: ApiKey).
Wire its diamond output port into every S3 operation node that should use this connection.
The satellite's config merges onto each connected node (merge key s3Server) — the satellite's values win over anything set directly on the operation node's own Region field.
A standalone operation node with no satellite connected still works using its own Region field plus a directly-attached vault credential — the satellite is the recommended shared-connection pattern, not a hard requirement.

Fields

Field	Required	Description
`region`	Required	One of 15 fixed AWS region codes (see below). Needed for SigV4 request signing even when Service URL points at a non-AWS backend. Default: `us-east-1`.
`useIamRole`	Optional	Only enable when the host runs on AWS with an attached IAM role (EC2/ECS/Lambda). When on, the vault credential is ignored and the SDK walks its default credential chain. Default: `false`.
`serviceURL`	Optional	Endpoint override. Leave blank for real AWS S3. Set to redirect to an S3-compatible backend — Backblaze B2, MinIO, Cloudflare R2, LocalStack, DigitalOcean Spaces. Must be a well-formed `http(s)` URL.
`forcePathStyle`	Optional	Use bucket-in-path URLs (`https://host/bucket/key`) instead of virtual-hosted style (`https://bucket.host/key`). Almost always required once `serviceURL` is set. Default: `false`.
`timeoutSeconds`	Optional	Per-request SDK timeout. Range 1–3600. Default: `60`.
`maxRetries`	Optional	SDK retry attempts on throttling/5xx (standard mode, exponential backoff with jitter). Range 0–10. Default: `5`.
`credentialTtlSeconds`	Optional	How long the resolved vault credential is cached in memory before the next call re-reads it (picks up rotated keys). Range 30–86400. Default: `300`.
`maxUploadBytes`	Optional	Upload payload ceiling. Range 1024 (1 KB) – 5368709120 (5 GB). Default: `104857600` (100 MB).
`maxDownloadBytes`	Optional	Download payload ceiling. Same range as upload. Default: `104857600` (100 MB).

The 15 Region Values

This exact list is the only set of values the Region field accepts — on the satellite and on every operation node's own standalone Region field — and the only set the backend validates against (INVALID_REGION otherwise, even when serviceURL points somewhere else entirely):

Region ID	Location	Region ID	Location
`us-east-1`	US East (N. Virginia)	`eu-west-1`	Europe (Ireland)
`us-east-2`	US East (Ohio)	`eu-west-2`	Europe (London)
`us-west-1`	US West (N. California)	`eu-west-3`	Europe (Paris)
`us-west-2`	US West (Oregon)	`eu-central-1`	Europe (Frankfurt)
`ca-central-1`	Canada (Central)	`ap-south-1`	Asia Pacific (Mumbai)
`ap-southeast-1`	Asia Pacific (Singapore)	`ap-northeast-1`	Asia Pacific (Tokyo)
`ap-southeast-2`	Asia Pacific (Sydney)	`ap-northeast-2`	Asia Pacific (Seoul)
`sa-east-1`	South America (São Paulo)

Pointing at Backblaze B2, MinIO, R2, or another non-AWS backend? Pick any region from the list above (e.g. us-east-1) — it's a signing-only value, not a routing value; it does not need to match the backend's own region naming. Service URL is what actually redirects traffic, and it accepts any well-formed http(s) URL regardless of which AWS region name you picked.

Credential Model

Mode	When	What you provide
Vault credential (default)	Normal use, any environment	An `ApiKey`-type vault record — Username = access key ID, Password = secret key
IAM role (`useIamRole=true`)	Host runs on EC2/ECS/Lambda with a role attached	Nothing — the AWS SDK walks its default credential chain

An optional STS session token is read from a secondary vault alias (sessionToken) rather than a config field, so a temporary token never lands in workflow JSON, exports, or backups.

Access-key format check is AWS-only. When Service URL is blank (real AWS), the access key ID must match AWS's own format (16–128 chars, ^[A-Z0-9]+$) or the node fails fast with INVALID_ACCESS_KEY_FORMAT. This check is skipped whenever Service URL is set, since S3-compatible providers use their own key-ID formats — e.g. Backblaze B2's keyID is lowercase hex.

Connecting to Backblaze B2

Field	Value
Region	Any value from the list above (e.g. `us-east-1`) — signing-only, does not need to match B2's own region code
Service URL	Your bucket's real B2 S3-compatible endpoint, e.g. `https://s3.us-east-005.backblazeb2.com`
Force Path Style	Checked
Vault credential	Secret type `ApiKey` — Username = B2 `keyID`, Password = B2 `applicationKey`

The same pattern applies to MinIO, Cloudflare R2, DigitalOcean Spaces, and LocalStack — set Service URL to that backend's S3-compatible endpoint and Force Path Style on.

Untested field parity on non-AWS backends: Canned ACL, Storage Class, and Server-Side Encryption option lists on the operation nodes are AWS-specific concepts, passed through verbatim to whatever endpoint Service URL points at. Non-AWS backends may silently ignore or reject some of these — verify each field against the specific backend's real behavior. Backblaze B2, for example, has no per-object canned ACL or storage-class concept; visibility is a bucket-level Private/Public setting instead.

Sample Configuration

// S3 Server satellite — real AWS
{
  "region": "us-east-1",
  "useIamRole": false,
  "timeoutSeconds": 60,
  "maxRetries": 5,
  "credentialTtlSeconds": 300,
  "maxUploadBytes": 104857600,
  "maxDownloadBytes": 104857600
}

// S3 Server satellite — Backblaze B2
{
  "region": "us-east-1",
  "serviceURL": "https://s3.us-east-005.backblazeb2.com",
  "forcePathStyle": true
}

Node Policies & GuardRails

Policy Area	Recommendation
Credential Storage	Store the access key ID / secret key pair in the BizFirst vault as an `ApiKey` record. Never hardcode in workflow configuration.
One Satellite Per Backend	Use a separate satellite per distinct backend/credential pair. An operation node can only be wired to one satellite at a time, so routing a workflow across two backends requires two satellites.
Region Field Confusion	Don't spend time trying to match a non-AWS backend's own region naming in the Region field — any valid AWS region code works since it's signing-only.
Force Path Style	Turn this on whenever Service URL is set. Almost every non-AWS S3-compatible backend requires bucket-in-path URLs.
Byte Caps	Lower `maxUploadBytes`/`maxDownloadBytes` from the 100 MB default if the workflow should never handle unexpectedly large files.