# Cloud Object Storage (S3)

Store files in an S3-compatible bucket (AWS S3, GCS interop, Cloudflare R2, MinIO). Use it as a workflow source or destination.

## What this connection offers

Browse an S3-compatible bucket, including supported AWS S3, GCS interoperability, R2, or MinIO configurations. Leave the endpoint blank for AWS S3 and supply it for another compatible store. This is the file/storage entry, separate from AWS S3 tools.

| Detail | Value |
| --- | --- |
| Available uses | stored files, folder and file operations |
| Sign-in | Credentials or access key |
| Catalogue identifier | `s3_storage` |
| Connection scope | tenant |
| Direction | both |

## Connect

1. Open **Connections**, choose to connect a service, and select **Cloud Object Storage (S3)** with the uses listed above.
2. Give the connection a recognisable name.
3. Fill the settings below in the connection form. Secret fields belong in the credential form, never in chat.
4. Check the connection status and run a connection test where offered.
5. Select this saved connection in the app, workflow step, storage browser, or Assistant task that needs it.

## Connection settings

| Setting | Type | Required | Secret | Explanation |
| --- | --- | --- | --- | --- |
| Endpoint URL (`endpoint_url`) | url | no | no | Leave blank for AWS S3; set for GCS / R2 / other S3-compatible stores. |
| Bucket (`bucket`) | text | yes | no | — |
| Region (`region`) | text | no | no | — |
| Access key ID (`aws_access_key_id`) | password | yes | yes | — |
| Secret access key (`aws_secret_access_key`) | password | yes | yes | — |

## Data operations

The offered data operations are `list`, `read`, `write`, `delete`, `copy`. Your role, provider access, and app policy can further restrict an operation.

## Update credentials

Rotate credentials on the saved connection, then test and check a dependent task. A hidden stored secret is not an empty secret. Supply a replacement only when you intend to change it.

## Diagnose a failure

Check the connected account, its permission to the target, the selected folder, table or collection, and the connection’s current status. A successful sign-in is not proof that a particular resource is shared with that account. An empty search or folder page is not necessarily an authentication error. Revoke access when it is no longer needed; deleting the connection can also affect its tools and synced data. See [connection lifecycle](/docs/connections/revoke-and-delete).