Connect an Amazon S3 bucket when an existing application should keep its storage while staff, partners, or other systems reach its files through Files.com. A Mount exposes the bucket as a Files.com folder; a Sync delivers a separate copy between locations. The connection targets one bucket in its AWS region and authenticates with IAM access keys or STS role assumption.

Choose a bucket and an AWS identity with the access your workflow needs. Check the storage classes and versioning settings as well: they determine which objects Files.com can read and what remains recoverable after deletion or replacement.

Region and Bucket

Select Amazon S3 when adding a Remote Server, and give the connection an identifiable internal name.

Files.com supports connecting to S3 buckets in many regions, including regions where Files.com itself doesn't have an AWS presence. This includes Govcloud. Contact us if you need to access a region you don't see listed and we will work to add it.

Files.com requires access to the bucket being used, so we recommend creating a bucket for the exclusive use of Files.com.

AWS Region

The AWS Region Code of your S3 bucket name can be found by using the get-bucket-location command of the AWS CLI tool. You can cross-reference the region code and region name using Amazon's online documentation.

Bucket Name

Your Amazon S3 bucket name can be found in the Amazon AWS Console, within the Amazon S3 section, under the Buckets list.

Authentication Information

Files.com supports two authentication methods for connecting to Amazon S3: Access Key with Secret Access Key and AWS STS with IAM Role Assumption.

Choose the method that fits your organization's security and credential management policies. Access keys fit an existing static-key and rotation process. STS role assumption uses temporary credentials and keeps the role's access policy in your AWS account; we recommend it for most production connections.

The authentication information can be placed in the Remote Server Credential Manager and selected when configuring the Remote Server.

Access Key with Secret Access Key

Provide an AWS Access Key ID and Secret Access Key associated with an IAM user that has permission to access the target S3 bucket.

The IAM user must have appropriate permissions for the operations you intend to perform. Scope permissions to the specific bucket and paths required, for least-privilege access.

This method stores long-lived credentials in Files.com.

AWS STS with IAM Role Assumption

Files.com supports authentication using AWS Security Token Service (STS) by assuming an IAM role in your AWS account. This method uses temporary credentials instead of long-lived access keys.

The connection requires an IAM role in your AWS account, its Role ARN, and a trust policy allowing Files.com to assume it. Files.com displays a sample trust policy and your site's External ID during setup. Apply that trust relationship and grant the role the bucket permissions needed for the work. The STS reference explains the relationship between the principal, External ID, and temporary credentials.

The Assume Role Session Duration setting, which defaults to 3600 seconds (1 hour), specifies the duration for the STS credential. This default matches the default for an IAM role. If the IAM role has a custom value for its Maximum session duration setting in AWS, configure the Files.com setting to a value equal to or lower than the IAM role's maximum session duration.

Files.com automatically renews temporary credentials before they expire to maintain uninterrupted access to S3.

Access Permissions

Regardless of authentication method, the IAM user or role must have permissions appropriate to the intended use of the Remote Server.

Restrict permissions to the specific bucket and object prefix required for your integration.

Read/Write Policy Example

Attach an identity-based policy to the IAM user or role used by this connection. The following example grants access to one bucket.

Use this example for read/write workflows. Restrict the actions and object paths for narrower workflows; bucket policies and other AWS controls can impose additional requirements. For SSE-KMS encrypted objects, the connection also needs KMS permissions.

Replace <bucketname> with your bucket name. Identity-based policies do not contain a Principal; the policy applies to the identity it is attached to.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::<bucketname>",
        "arn:aws:s3:::<bucketname>/*"
      ]
    }
  ]
}

Read-Only Permission

Access to the S3 bucket is determined by the policies and permissions in Amazon S3.

If your S3 bucket is read-only, or you wish Files.com to be restricted to read-only permissions, then configure the S3 user policy (replace <bucketname> with your bucket name) as below:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
           "s3:GetObject",
           "s3:ListBucket",
           "s3:GetBucketLocation"
         ],
         "Resource": [
           "arn:aws:s3:::<bucketname>",
           "arn:aws:s3:::<bucketname>/path/to/subfolder/*"
         ]
      }
   ]
}

The AWS policy permissions are separate from Files.com permissions.

When you restrict AWS access to read-only, also set any Files.com users with permission to access this bucket to read-only user permissions.

KMS Key Permissions

For SSE-KMS, the IAM user or role used by the connection needs kms:GenerateDataKey on the key for writes and kms:Decrypt for reads. Multipart uploads require both permissions, even if the workflow only uploads files. These permissions are in addition to the S3 permissions above; a read-only connection still needs kms:Decrypt for the keys used to encrypt the objects it reads.

Scope these permissions to the required key ARNs. The KMS key policy must permit the identity to use the key, either directly or by enabling the IAM policies that grant access. If you change the configured key, retain access to earlier keys for as long as the connection needs to read objects encrypted with them.

Subfolder-Restricted Credentials

If your S3 user policy does not have access to the entire bucket, or is restricted to specific subfolders, verification of access to the bucket may fail when testing credentials.

Use the Access Level for These Credentials on the Remote Server setting to specify an accessible subfolder for verifying access when testing your credentials.

Customer-Managed KMS Keys

If your bucket policy requires each write to specify a particular AWS Key Management Service (KMS) key, configure the optional KMS Key ARN setting on the Amazon S3 Remote Server. Files.com requests server-side encryption with AWS KMS (SSE-KMS) for objects it writes, using the key your organization controls. This lets you use the bucket through Files.com while retaining its encryption requirements.

The value must be the key's full Amazon Resource Name (ARN), such as arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab. Key IDs and aliases are not accepted. The key must be in the same AWS region as the bucket. GovCloud key ARNs beginning with arn:aws-us-gov:kms: are supported.

KMS Key ARN is available after AWS Region when creating the Remote Server, and under Settings > Remote Server Connection on an existing connection. It works with both IAM access keys and STS role assumption.

The configured key applies to objects Files.com writes through Remote Server Mounts and Syncs, including multipart uploads, copies within the bucket, and the slash files that represent folders. Uploads through Direct Routing use the key as well.

Leave the setting blank if your bucket does not require Files.com to specify a particular key. Changing or clearing the setting affects subsequent writes; it does not change the encryption of existing objects. If the bucket policy still requires the key, clearing the setting causes writes to be rejected. S3 decrypts objects when they are read, using the key that encrypted each object and the connection's KMS permissions.

Incomplete Multipart Uploads

Files.com uses the Amazon S3 Multipart Upload API when transferring large files to your bucket. Multipart Upload improves performance and reliability by uploading file parts in parallel, but unfinished uploads can accumulate if they're never completed or aborted.

By default, S3 does not automatically delete incomplete multipart uploads. Any unfinished parts remain stored indefinitely and continue to incur storage costs.

To prevent unnecessary storage usage, we strongly recommend setting up an AbortIncompleteMultipartUpload lifecycle rule in your S3 bucket configuration. This rule automatically cleans up uncompleted uploads after a set period.

Here is an example rule:

{
  "Rules": [
    {
      "ID": "Abort incomplete uploads after 7 days",
      "Status": "Enabled",
      "Filter": {},
      "AbortIncompleteMultipartUpload": {
        "DaysAfterInitiation": 7
      }
    }
  ]
}

This rule tells Amazon S3: if a multipart upload was initiated more than seven days ago and hasn't been completed or aborted, automatically abort it and delete all uploaded parts. Adjust the DaysAfterInitiation value as needed for your storage policies.

Supported S3 Storage Classes

Files.com supports reading and writing objects in the following S3 storage classes: Standard, Standard-IA, One Zone-IA, Intelligent-Tiering, and Glacier Instant Retrieval.

Objects in Glacier Flexible Retrieval and Glacier Deep Archive must be restored in AWS before Files.com can download them. Files.com does not initiate the restore. For ongoing Mount and Sync workflows, keep objects in a storage class that provides immediate access; see S3 troubleshooting for archived-object errors.

Transfer Paths

Eligible client uploads and downloads use Direct Routing automatically. Amazon S3 also supports direct web uploads. Directly transferred contents avoid Files.com's network and Transfer Usage; buffering and required processing can change an upload's path.

A mounted bucket can be a source or destination for Automations as well as user operations. The shared Remote Server guidance explains the relationship between mounted access, Sync delivery, and workflow processing.

Case Sensitivity

Account for case sensitivity differences when copying, moving, or syncing files and folders between Amazon S3 and other storage locations. Amazon S3 is a case-sensitive system whereas other systems may not be. Files can be overwritten and folder contents merged when their case-insensitive names match.

Versioning

Amazon S3 supports bucket versioning. When versioning is enabled, S3 retains every version of each object. Files.com's standard file listing shows only the current version. Previous versions are not visible in the regular file browser.

When you delete a versioned object, S3 places a delete marker in the bucket rather than removing the object permanently. The object appears absent from the Files.com file browser, but previous versions remain in the bucket and continue to accrue storage costs.

Files.com supports point-in-time browsing for S3 buckets with versioning enabled. Point-in-time browsing lets you view and recover previous versions of files directly from the Files.com file browser.

For details on how deletions, renames, and moves behave on versioned buckets, see Object Storage Behavior.

Folder Representation Using Slash Files

Files.com presents object-key prefixes as folders and creates slash-file placeholders when needed, including for empty folders. These objects can be visible to other applications using the bucket. Folder moves and renames can require per-object copies and deletions rather than one directory operation.