Amazon S3
Read/write objects in an S3 bucket.
Settings
What the connection form asks for. Every connection has a Staging side, which it needs, and an optional Production side with values of its own; both ask for the same settings.
| Bucket | |
| Region | Defaults to us-east-1 if left blank. |
| Endpoint (S3-compatible, optional) | Set only for S3-compatible stores (MinIO, Cloudflare R2, Wasabi, Backblaze, or Google Cloud Storage's XML API at https://storage.googleapis.com with an HMAC interoperability key). Leave blank for AWS. |
| Access Key ID | Leave blank to use the IAM role / instance profile attached to the server (recommended when Trinium runs on EC2/ECS). |
| Secret Access Key | Leave blank to use the server's IAM role / instance profile. Stored encrypted, and never shown again after you save it. |
Testing the connection
Test lists the bucket. A wrong key, an expired session or a missing bucket fails. A real key that is not allowed to list still passes, because S3 checks the signature before the permissions, and a key that may only read files is a normal, least-privilege setup.
Good to know
- Leaving the keys blank uses the server's IAM role or instance profile, and only on a shared connection an administrator manages. Each side decides for itself, so Staging can use a key while Production uses the role.
- The endpoint setting reaches S3-compatible stores such as MinIO, Cloudflare R2, Wasabi and Backblaze.
Nodes that use it
Copy, move or delete the files an input, List Files or File from URL hands it through its Files anchor, before the data is processed or after the run succeeds or fails.
List the files in a folder as rows, with each one's path, name, size and modified time, without reading any of them.
Write the pipeline's output to an S3 bucket with a templated key (dates, run id) and a write mode.
Read a single object or a whole prefix from an S3 bucket. A Bookmark can read only the files no successful run has read.