AWS S3

Calls the Amazon S3 REST API with an IAM access key across 47 operations, signed with SigV4. Objects: upload from text or base64 (with content type, cache headers, storage class, encryption, custom metadata and tags), download as text or base64 with byte ranges and conditional requests, head, get attributes, server-side copy, delete one key or one version, delete up to 1000 in a single batch, list a prefix with delimiters and continuation tokens, list every version, and restore from Glacier. Presigned URLs perform GET, PUT, HEAD or DELETE - so a workflow can hand someone an UPLOAD link, not only a download link - capped at SigV4's seven-day ceiling. Also object tags, ACLs, Object Lock retention and legal holds, the four S3 Annotations operations that attach model output to an object, the full multipart family for large files, bucket create/delete/list/head/location/versioning/tagging, and bucket CORS, lifecycle and default-encryption configuration. An object key containing a . or .. segment is refused rather than silently normalized onto a different object, and every XML request body escapes the values it carries. A custom endpoint on the credential points the same node at S3-compatible storage such as MinIO, Wasabi, DigitalOcean Spaces or Backblaze B2. No trigger node: S3 event notifications can only be delivered to SNS, SQS, Lambda or EventBridge, never to an arbitrary HTTPS callback.

Credential: AWS IAM access key (accessKeyId, secretAccessKey, region, bucket) - see Credentials.

IAM actions

Each operation below lists the IAM action it needs. IAM actions are allowed on the IAM identity behind the access key, and not denied by the bucket policy. S3 has NO OAuth and no scopes - the equivalent question is which IAM action the key may perform on which resource, which is exactly what an AccessDenied error is asking for. Two of them are commonly missed: s3:ListBucket is granted on the BUCKET arn rather than on bucket/*, so a policy that only names the objects lets you read a key you already know and never lets you list; and s3:ListAllMyBuckets is granted on arn:aws:s3:::*. If a run fails with a permission error, the node names the missing IAM action in the error - grant it and re-run; you do not need to rebuild the workflow.

Operations (47)

Objects — read

Objects — write

Object tags, permissions and lock

Object annotations

Large uploads (multipart)

Buckets

Bucket CORS, lifecycle and encryption

Example

Hand a customer a download link that expires, without making the file public

A workflow generates an invoice PDF and needs to get it to one customer. Making the object public exposes it to anyone who guesses the key, and emailing the bytes does not scale. A presigned URL is a link that carries its own time-limited authorization: it works for exactly as long as you say, for exactly that one object, and needs no AWS account at the other end.

Set Operation to getSignedUrl, then fill in:

Sets {{link.url}} (the signed link, ready to paste into an email node), plus {{link.method}}, {{link.expiresIn}}, {{link.bucket}} and {{link.key}}. No request is sent to S3 - the signature is computed locally - so this costs nothing and cannot fail on a missing object. The link stops working when it expires, or sooner if the access key behind it is revoked.