Security and Access Control for S3

The Files.com S3-compatible endpoint enforces authentication and encryption on every request, and applies the same permission model used by every other Files.com protocol.

Encryption

Connections to the S3-compatible endpoint always use HTTPS with modern TLS. Files.com encrypts objects at rest using server-side encryption. You do not need to configure encryption manually unless your workflow requires additional metadata for client-side encryption.

Authentication and Authorization

S3-compatible operations authenticate using Access Key ID and Secret Access Key pairs. Each Access Key ties to a Files.com API Key, inheriting the key's permissions and folder visibility.

You can revoke or rotate keys at any time. Revoking a key prevents subsequent requests from authenticating with it.

S3 Protocol Access

The site-wide endpoint must be enabled before any user can connect through S3. User and group permissions determine who can connect while the endpoint is enabled.

The user associated with an S3-compatible API key must have S3-Compatible Endpoint access. This is a separate protocol permission from Web, Desktop App, and API. It lets you run an S3-only service account without giving it access through those other methods. Disabling Web, Desktop App, and API access does not block S3 connections, and changing S3 access does not change the user's other protocol permissions.

Site Administrators manage S3 access under Privileges > Protocol Access on the user or group details page. Workspace Administrators can manage it for users and groups in their own Workspace. Site Administrators also need S3 protocol permission to connect through the endpoint.

By default, a user can connect if S3 is allowed directly on their account or through any group they belong to. New users have S3 allowed; new groups have it disallowed. If Protocol access can be managed at group only is enabled, only group grants count. The user's own S3 setting is ignored, including its enabled default.

To stop all S3 access for a user, remove every applicable S3 grant. Disallowing it on the user alone does not remove access inherited from a group. Changing a group's S3 permission affects every member; removing the user from that group also removes the other access it grants.

Removing S3 permission does not delete the keys; restoring permission allows otherwise valid keys to work again. To revoke one integration's credential permanently, delete its key instead.

Permissions and Access Boundaries

Files.com applies the same account and folder permissions to S3 operations that it applies to other protocols. Users only see objects they are authorized to access.

Partner users, user permission fences, and root-folder restrictions all apply to S3 traffic.

Network Access and Endpoint Control

Site Administrators can enable or disable the inbound S3-compatible endpoint for the entire site using the S3-Compatible Endpoint Enabled switch under Clients & Protocols > S3 Compatible > Settings in the web app. Only Site Administrators have access to this page. The setting is enabled by default and applies to every Workspace, including the Default Workspace. The Site API exposes the same control as s3_compatible_endpoint_enabled.

Use this control when your organization does not permit S3 connections or needs to stop S3 access across the site. Disabling it blocks every user's inbound S3 access, including Site Administrators, even when their account or a group grants S3 permission. You do not need to change user or group grants or enable Protocol access can be managed at group only, which changes permission assignment for every protocol.

S3-compatible API keys and user and group grants are retained. Re-enabling the endpoint allows new connections with otherwise valid keys according to those grants, including the groups-only rules when they apply.

As with disabling FTP, SFTP, or WebDAV for the site, disabling the S3-compatible endpoint signs out existing login sessions across the site, including sessions through other protocols. API keys are not revoked, so Desktop and Mobile App sessions remain signed in through the REST API. Users and clients can authenticate again through other enabled protocols; their protocol permissions and the other site-wide protocol settings are unchanged.

This setting controls clients connecting to Files.com through S3. It does not disable Files.com's outbound connections to Amazon S3 or S3-compatible Remote Servers, including their Mounts and Syncs.

If your organization restricts traffic through firewalls, allow outbound HTTPS access to the Files.com S3-compatible endpoint. Because Files.com uses regional architecture and DNS-based routing, allow connections based on DNS name rather than static IP addresses.

Use Inbound S3 Logs to investigate S3 requests. Administrative configuration changes appear in Settings Changes.