StorafleetStorafleet
Log inStart for free

/// CONNECT A PROVIDER / AMAZON S3

Amazon S3

Connect a native Amazon S3 bucket two ways: paste IAM access keys, or — the recommended path — let storafleet assume a keyless IAM Role in your account so no long-lived credentials are ever stored.

Don't have a Amazon S3 bucket yet? Create one first →
Use the IAM Role for anything beyond a quick test — it keeps every credential inside your AWS account.

Two ways to connect

  • IAM access keys — paste the Access Key ID and Secret Access Key of a dedicated, least-privilege IAM user.
  • Keyless IAM Role (recommended) — a CloudFormation stack creates a role that trusts storafleet, scoped by a per-connection ExternalId. storafleet assumes it via STS for temporary credentials and stores no long-lived keys.

IAM Role (recommended)

Pick IAM Role in the Create Fleet wizard. storafleet generates a unique ExternalId for this connection and a CloudFormation quick-create link. The flow:

  1. Click Launch CloudFormation — the quick-create stack opens in your AWS console, pre-filled.
  2. Acknowledge the IAM-resources checkbox and Create stack. It creates an IAM role (not a user) that trusts storafleet only when the ExternalId matches this one connection.
  3. When the stack reaches CREATE_COMPLETE, copy the RoleArn from its Outputs tab and paste it back into the wizard.

storafleet assumes the role through AWS STS to obtain temporary credentials for each call. Because the scoping is enforced by the per-connection ExternalId, the role can't be assumed by anyone else — and storafleet keeps only the role ARN, never long-lived keys.

Access keys

Screenshot: the provider's key / secret confirmation screen — copy both values now (the secret is often shown only once).

Pick Access Keys and paste the Access Key ID and Secret Access Key of a dedicated IAM user scoped to just this bucket. Create a least-privilege user for storafleet — never use root credentials or a broadly permissioned key.

Pick a region

Choose the AWS region the bucket lives in. This determines the S3 endpoint storafleet talks to, so it must match where the bucket was created.

Required permissions

Both methods grant the same minimum, least-privilege actions on the one bucket (the IAM-Role template sets these for you):

  • s3:ListBucket, s3:GetBucketLocation — on the bucket
  • s3:GetObject, s3:PutObject, s3:DeleteObject — on bucket/*

See the Permissions page for the full policy, and IAM Role for how the keyless flow works end to end.

NextCloudflare R2