Amazon S3 integration

Back to list of integrations

Use the Amazon S3 integration to upload, read, list, move, and delete files, generate signed URLs, and decrypt PGP-encrypted files through Action Tools. It also provides a trigger for new or updated files.

Authentication	Actions	Triggers
AWS IAM	(7)	(1)

​

Supported actions

Action	Use it to
Upload File	Upload a file to S3.
Read File	Read an S3 file for use in later steps.
Generate Signed URL	Generate a signed URL for an S3 object.
Move File	Move a file to another folder.
Delete File	Delete an S3 object.
List Files	List files in an S3 bucket folder or prefix.
Decrypt PGP File	Decrypt an S3 file using a private key stored in AWS Secrets Manager.

​

Triggers

Trigger	Fires when
New or Updated File	A file is added or updated in the selected bucket or folder. The selected location must contain no more than 10,000 files. Markdown and Folder Path are optional settings.

​

Prerequisites

• An AWS account and IAM credentials with access to the S3 bucket and operations used by your actions.
• For Decrypt PGP File, a private key stored in AWS Secrets Manager and permission to access the secret.

​

Set up the integration

1. Prepare AWS IAM credentials

   Prepare AWS IAM credentials and the Region for the S3 bucket. Ensure the IAM principal has permission to perform the S3 operations used by your actions. For Decrypt PGP File, it also needs permission to retrieve the private key from AWS Secrets Manager. See Using identity-based policies for Amazon S3.

2. Create the auth profile

   In Integrations, select Amazon S3 > Connect. On Project Auth Profiles, select New Profile > Integration Profile > Amazon S3 > Continue. Configure the AWS IAM credentials and select Create Profile.

3. Create the action tool

   In Tools, select New Tool > Action > Amazon S3 > Continue. Select the Action and Auth Profile, configure the inputs, and select Create Tool. Then assign the tool to an agent.

​

Action reference

The inputs below match the fields shown in Studio for each action.

Upload File

Parameter	Type	Required	Description
file	string	Yes	The file to upload to S3.
fileName	string	No	The S3 file name. If blank, a unique name is generated.
acl	enum	No	Access setting: Private for internal files or Public Read to make the file publicly accessible by URL.
type	string	No	Content type. If blank, the API attempts to determine it.

Read File

Parameter	Type	Required	Description
key	string	Yes	Full path to the file in the S3 bucket, such as documents/report.csv.

Generate Signed URL

Parameter	Type	Required	Description
key	string	Yes	Full path to the S3 object.
expiresIn	number	Yes	URL validity in minutes. Defaults to 10.

Move File

Parameter	Type	Required	Description
fileKey	string	Yes	Full path to the file to move.
folderKey	string	Yes	Destination folder path. The file name is kept the same.

Delete File

Parameter	Type	Required	Description
key	string	Yes	Full path to the file in the S3 bucket.

List Files

Parameter	Type	Required	Description
prefix	string	No	Folder path to filter by, including the trailing slash. Leave blank to list the whole bucket.
maxKeys	number	No	Maximum results (1–1000). Defaults to 1000.

Decrypt PGP File

Parameter	Type	Required	Description
key	string	Yes	Path of the encrypted file in S3.
secretArn	string	Yes	ARN of the AWS Secrets Manager secret containing the PGP private key.
passphraseArn	string	No	ARN of the secret containing the private-key passphrase, if needed.
secretsManagerRegion	string	No	Region containing the secret. Defaults to the S3 region.
allowUnauthenticatedMessages	boolean	No	Allows decryption without message integrity protection. Defaults to false; use only for legacy files.
allowInsecureDecryptionWithSigningKeys	boolean	No	Allows a key not marked for encryption to decrypt the file. Defaults to false.

​

Troubleshoot common issues

Issue	Resolution
An S3 action returns an access error	Confirm the IAM principal has the required S3 permissions for the bucket and operation.
Read File, Move File, or Delete File can’t find an object	Verify the S3 object key or folder path.
Decrypt PGP File fails	Verify secretArn identifies the private key secret and that the IAM principal can access it.
The trigger doesn’t detect a file	Confirm the selected bucket or folder contains no more than 10,000 files.

​

Related articles

• Auth profiles
• Action Tools
• Amazon S3 documentation