StorafleetStorafleet
Log inStart for free

/// GETTING STARTED / CONNECT A FLEET

Connect a Fleet

A Fleet is one connected bucket. You connect each bucket individually — from the Fleet page, click Create Fleet, give it a display name, the bucket name, and a region, then choose how storafleet authenticates.

One workspace can hold Fleets across many different AWS accounts — each Fleet is an independent connection with its own role or keys.

Two ways to connect

  • IAM Role (recommended) — no access keys ever leave your account. storafleet assumes a cross-account role via AWS STS. Best for production and corporate accounts.
  • Access keys — paste an IAM user's access key ID + secret. Also the path for S3-compatible providers that use a custom endpoint.

IAM Role (recommended)

Pick IAM Role in the Create Fleet wizard and click Next. storafleet generates a unique ExternalId for this connection and a CloudFormation quick-create link. The flow:

  1. Click Launch CloudFormation — it opens in your AWS console, pre-filled.
  2. Acknowledge the IAM-resources checkbox and Create stack. The stack creates an IAM role (not a user) scoped to this one bucket, trusting storafleet only when the ExternalId matches. Optionally it creates the bucket too, hardened (versioning + encryption + public-access-block).
  3. When the stack shows CREATE_COMPLETE, copy the RoleArn from its Outputs tab and paste it back into the wizard → Connect Fleet.

storafleet verifies the role can be assumed only with the ExternalId, then stores just the role ARN — no long-lived keys are saved.

To put another account's bucket under the same workspace, run the Create Fleet wizard again and launch the stack in that account. Already on access keys? Open the Fleet's Edit dialog → Upgrade to IAM Role.

Access keys

Pick Access Keys and enter an IAM user's Access Key ID and Secret Access Key for the bucket. For an S3-compatible provider, also set the custom endpoint. Create a dedicated IAM user scoped to just the bucket — never use root credentials. Access keys belong to a single AWS account.

Required permissions

Both methods grant the same least-privilege actions on the one bucket (the IAM-Role template sets these for you):

  • s3:ListBucket, s3:GetBucketLocation — on arn:aws:s3:::BUCKET
  • s3:GetObject, s3:PutObject, s3:DeleteObject — on arn:aws:s3:::BUCKET/*

See the Permissions page for the full policy.

Credential storage

IAM Role Fleets store no key material — only the role ARN. For access-key Fleets, your Access Key ID and Secret Access Key are encrypted with AES-256-GCM before being written to the database, using a key derived per-account via HKDF-SHA256, decrypted in memory only for an AWS call, and never logged. See Credential Security for the full details.

PreviousQuickstart
NextCredential Security