# AWS S3

List buckets, list objects, and read small text objects from S3.

## What this connection offers

This entry exposes S3 tools to the Assistant. For the folder-oriented Storage browser and snapshot imports, use the separate Cloud Object Storage (S3) connection. Tool permissions depend on the credentials supplied.

| Detail | Value |
| --- | --- |
| Available uses | Assistant tools |
| Sign-in | Credentials or access key |
| Catalogue identifier | `com.aws.s3` |
| Connection scope | tenant |

## Connect

1. Open **Connections**, choose to connect a service, and select **AWS S3** with the uses listed above.
2. Give the connection a recognisable name.
3. Fill the settings below in the connection form. Secret fields belong in the credential form, never in chat.
4. Check the connection status and run a connection test where offered.
5. Select this saved connection in the app, workflow step, storage browser, or Assistant task that needs it.

## Connection settings

| Setting | Type | Required | Secret | Explanation |
| --- | --- | --- | --- | --- |
| AWS access key ID (`access_key_id`) | text | yes | no | — |
| AWS secret access key (`secret_access_key`) | password | yes | yes | — |
| Region (`region`) | text | yes | no | AWS region name (e.g. us-east-1, eu-west-1). |

## Update credentials

Rotate credentials on the saved connection, then test and check a dependent task. A hidden stored secret is not an empty secret. Supply a replacement only when you intend to change it.

## Diagnose a failure

Check the connected account, its permission to the target, the selected folder, table or collection, and the connection’s current status. A successful sign-in is not proof that a particular resource is shared with that account. An empty search or folder page is not necessarily an authentication error. Revoke access when it is no longer needed; deleting the connection can also affect its tools and synced data. See [connection lifecycle](/docs/connections/revoke-and-delete).