Add events to send notifications to SNS Topic

Copy an object in S3 from one location to another

Create an Amazon SNS Topic to be used with S3 Event Notifications

Deletes the S3 bucket. All objects in the bucket must be deleted before the bucket itself can be deleted

Generate presigned URL's that can be used to upload or download an object in S3

Generate a presigned URL that can be used to upload or download an object in S3

Get the location (AWS region) of a bucket by name

Returns the notification configuration of a bucket

Retrieves all the metadata from an object without returning the object itself

Gets the Object Lock configuration for a bucket

Determine if a bucket exists and if you have permission to access it

Retrieve metadata from an object without returning the object itself

bucket-1

Lists in-progress multipart uploads in a bucket

Replace an existing bucket notification configuration with a new one

:::note
**File Contents** can be a reference to a binary file from a previous step.
For example, if you have an [HTTP Get](components/http.mdx#httpget) action that pulls down a .png image, you can reference its step name to write the .png to S3.
Or, **File Contents** can be simple text, like `'Hello World'`.
:::


Places an Object Lock configuration on the specified bucket

Places an Object Retention configuration on an object

Subscribe to an Amazon SNS Topic for S3 Event Notifications

Unsubscribe from an Amazon SNS Topic for S3 Event Notifications

Update an Amazon SNS Topic Policy to grant S3 permission to publish

Upload a chunk of a multipart file upload

The Amazon S3 connector accesses Amazon S3 data via the Amazon S3 API.This connector allows you and your customers to integrate Amazon S3 with your product, enabling your customers to work with buckets, objects, parts and more in Amazon S3.

About the Amazon S3 connector

Amazon S3

Quickly build integrations connecting your B2B SaaS product to Amazon S3. 

Yes. Prismatic offers built-in connectors for a variety of other data storage systems including Azure Files, Google Cloud Storage, Bynder, and Frontify. These and other connectors are available from our <a href="https://prismatic.io/connectors/" rel="noopener noreferrer" target="_blank">connector library</a>.

No. This connector requires an <a href="https://prismatic.io/docs/components/aws-s3/#aws-api-key-and-secret" rel="noopener noreferrer" target="_blank">AWS IAM access key pair</a>.

Yes. The connector leverages Amazon’s Simple Notification Service (SNS).

Yes. Here are the instructions for <a href="/docs/custom-components/writing-custom-components/" rel="noopener noreferrer">writing custom connectors</a> in Prismatic.

FAQs for Amazon S3 integrations

Amazon S3 Connector

An AWS IAM [access key pair](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) is required to interact with Amazon S3.
Ensure the key pair generated in AWS has proper permissions to the S3 resources to access.
Read more about S3 IAM actions in the [AWS documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html).

#### Prerequisites

- An [AWS account](https://aws.amazon.com/) with IAM access
- Appropriate permissions to create IAM access keys

#### Setup Steps

To create an IAM access key pair:

1. Sign in to the [AWS Console](https://aws.amazon.com/) and navigate to **Identity and Access Management (IAM)**
2. Select the IAM user that will be used for the integration
3. Navigate to the **Security credentials** tab
4. Under the **Access keys** section, select **Create access key**
5. Choose the appropriate use case (e.g., **Third-party service** or **Application running outside AWS**)
6. Copy both the **Access key ID** and **Secret access key** when displayed

:::warning Secret Key Visibility
The **Secret access key** is only shown once during creation. If it is not copied at this time, a new access key pair must be created.
:::

#### Configure the Connection

- Enter the **Access key ID** into the connection configuration
- Enter the **Secret access key** into the connection configuration


AWS Assume Role authentication allows assuming an IAM role using temporary security credentials.
This method is useful for cross account access or when implementing principle of least privilege.

Refer to the [AWS documentation on assuming roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html) for detailed information.

#### Prerequisites

- Completed [API Key Secret](#apikeysecret) connection setup (access key pair required)
- Appropriate permissions to create IAM roles

#### Setup Steps

An IAM user with access keys is required to assume a role. If access keys have not been created, follow the [API Key Secret](#apikeysecret) setup steps first, then return here to create the IAM role.

##### Create an IAM Role with Trust Policy

1. From the [IAM Console](https://console.aws.amazon.com/iam/), navigate to **Roles** and select **Create Role**
2. Select **Custom trust policy** as the trusted entity type
3. Enter the trust policy below, replacing `USER_ARN` with the IAM user ARN:

<details>
<summary>View trust policy template</summary>

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "USER_ARN"
 },
 "Action": "sts:AssumeRole"
 }
 ]
}
```

</details>

4. Click **Next** and attach the appropriate S3 permissions policy (e.g., **AmazonS3FullAccess** or **AmazonS3ReadOnlyAccess**)
5. Complete the remaining steps and select **Create Role**
6. Copy the **Role ARN** from the role summary (format: `arn:aws:iam::123456789012:role/role-name`)

#### Configure the Connection

- **Role ARN**: The ARN of the IAM role to assume
- **Access Key ID**: From the IAM user (see [API Key Secret](#apikeysecret))
- **Secret Access Key**: From the IAM user
- **External ID** (optional): Shared secret for enhanced security

:::note External ID
The **External ID** provides additional security for cross-account access. Refer to the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html#id_roles_third-party_external-id) for more information.
:::

#### Verify Connection

The IAM user credentials assume the role, which provides temporary credentials with the role's attached permissions. Ensure the trust policy correctly references the IAM user ARN.

[Amazon S3](https://aws.amazon.com/s3/) is an object storage service from Amazon Web Services (AWS).
This component allows you to create, read, update, move, list, and delete objects (files) within an Amazon S3 bucket.

#### API Documentation

This component was built using the [Amazon S3 API Reference](https://docs.aws.amazon.com/AmazonS3/latest/API/Type_API_Reference.html).


Checks for new and updated files in a specified S3 bucket on a configured schedule.

The **New and Updated Files** trigger checks for new and updated files in a specified S3 bucket on a configured schedule. It monitors file changes based on the `LastModified` timestamp of objects.

For more information on S3 objects, see [Working with Amazon S3 objects](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingObjects.html).

#### How It Works

1. Run on the configured schedule (e.g., every 5 minutes)
2. List objects in the bucket using the [ListObjectsV2 API](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ListingKeysUsingAPIs.html) (up to 4,000 objects)
3. Compare each object's `LastModified` timestamp against the last poll time
4. Return keys for any files modified since the last poll
5. Maintain state to track the last poll time automatically

On the first run, the trigger sets the poll timestamp without returning files. Subsequent runs detect files created or modified after that timestamp.

#### Configuration

- **Connection**: AWS IAM credentials (Access Key or dynamic credentials)
- **AWS Region**: The region where the S3 bucket is located
- **Bucket Name**: The name of the S3 bucket to monitor

#### Returned Data

The trigger returns an array of object keys (file paths) that have been created or modified since the last poll. When no changes are detected, returns an empty array and sets `polledNoChanges` to `true`.

<details>
<summary>View example response</summary>

```json
{
 "data": [
 "path/to/new-file.txt",
 "path/to/updated-file.pdf",
 "images/photo.jpg"
 ]
}
```

</details>

#### Best Practices

- **Polling Frequency**: Use 5-15 minute intervals for active buckets; longer intervals for low-activity buckets
- **Object Limit**: The trigger checks up to 4,000 objects per poll; for larger buckets, consider using the [Webhook](#snss3notificationwebhook) trigger with SNS notifications instead
- **Permissions**: The IAM credentials require `s3:ListBucket` permission on the bucket

Checks for new buckets on a configured schedule.

Trigger to handle SNS subscription for S3 event notifications

The **Webhook** trigger receives event notifications from Amazon S3 via [Amazon SNS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html) when changes occur in a monitored S3 bucket. It handles both subscription confirmation and notification events automatically.

For real-time notifications without polling delays, use this trigger instead of the [New and Updated Files](#pollchangesfilestrigger) polling trigger.

#### How It Works

1. When an SNS topic subscribes to the flow URL, AWS sends a `SubscriptionConfirmation` message
2. The trigger automatically confirms the subscription by requesting the `SubscribeURL`
3. After confirmation, the trigger receives `Notification` messages containing S3 event data
4. Messages are routed to the appropriate branch based on type

#### Branch Logic

This trigger uses branching to route different message types:

- **Subscribe**: Routes SNS subscription confirmation messages (automatically confirmed)
- **Notification**: Routes S3 event notifications containing bucket and object information

#### Configuration

To configure S3 event notifications:

1. Create an SNS topic using the **Create Topic For S3 Event Notification** action
2. Update the topic policy using the **Update Topic Policy For S3 Event Notification** action
3. Subscribe to the topic using the **Subscribe to Topic** action with the flow URL as the endpoint
4. Configure bucket notifications using the **Bucket SNS Event Trigger Configuration** action

A full list of supported S3 event types is available in the [Event notification types documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html).

#### Returned Data

The trigger returns the parsed SNS message in the payload body. The `Message` field contains a JSON string with S3 event records that can be parsed for bucket name, object key, and event type.

<details>
<summary>View example response</summary>

```json
{
 "Type": "Notification",
 "MessageId": "22b80b92-fdea-4c2c-8f9d-bdfb0c7bf324",
 "TopicArn": "arn:aws:sns:us-east-2:123456789012:MyTopic",
 "Subject": "Amazon S3 Notification",
 "Message": "{\"Records\":[{\"eventName\":\"ObjectCreated:Put\",\"s3\":{\"bucket\":{\"name\":\"my-bucket\"},\"object\":{\"key\":\"test-file.txt\"}}}]}"
}
```

</details>

#### Best Practices

- **Region**: The SNS topic must be in the same AWS region as the S3 bucket
- **Topic Type**: Use standard SNS topics; FIFO topics are not supported for S3 notifications
- **Delivery**: Notifications are delivered at least once but may arrive out of order or as duplicates