23 Amazon S3 Connector
Use this guide for an Amazon S3 connector. Nous indexes objects in the selected bucket and optional prefix.
23.1 What is indexed or searched live
The connector indexes supported objects that the AWS credential can list and read. A prefix limits the object key path. S3 object ACLs do not replace the Nous workspace and Team access rules.
23.2 Administrator role and authentication
An AWS administrator or IAM administrator should create a dedicated least- privilege integration identity. The customer creates the AWS access key and secret for the standard customer path. Never use a root access key.
The identity needs s3:ListBucket for the bucket and s3:GetObject for the selected objects. Add s3:GetBucketLocation when required by the AWS account policy.
23.3 Provider setup and permissions
Create an IAM policy limited to the target bucket and prefix. Create an IAM user access key for the customer connector. Store the secret once, in the connector credential form, and rotate it under the normal AWS key policy.
23.4 Setup form fields
| Field | What to enter |
|---|---|
| Name | A unique workspace connector name. |
| Bucket Name | The S3 bucket name, without s3://. |
| Prefix | Optional object-key prefix, such as policies/2026/. |
| AWS Access Key ID | The customer-created access key ID. |
| AWS Secret Access Key | The matching secret. |
| Who has access | Choose Everyone in the workspace or Specific Teams. |
23.5 Workspace and Team access
AWS IAM controls what Nous can read. Nous access controls who can search the indexed result. Use Specific Teams for a limited audience. Portal manages Team membership. A Team share cannot grant access to an object outside the IAM policy.
23.6 Test the connection
- Save the connector and wait for source sync and search indexing.
- Confirm that a known object in the selected prefix appears.
- Search for a phrase from the object content.
- Test as an intended Workspace or Team member.
23.7 Common errors
| Error | Action |
|---|---|
| Access denied on list | Add s3:ListBucket for the bucket and check the prefix condition. |
| Access denied on read | Add s3:GetObject for the selected object path. |
| Bucket is not found | Check the exact bucket name and AWS account. |
| Key is rejected | Create a new access key, save it, test, then revoke the old key. |
23.8 Reconnect, rotate, and remove
Create and test the replacement AWS access key before retiring the old one. Then open the Portal connector page, find the Connection card, choose Replace credential, and enter the new access key ID and secret. You can also choose Update values from the key’s ⋯ menu in the Credentials tab, which shows every connector that uses it. Enter the replacement before you disable the old key in AWS. This also applies to connectors created before Portal stored credentials, which show Legacy credential until the replacement is saved. A connector created before Portal stored credentials that uses S3 role-based authentication cannot be moved into Portal this way. See Replace a credential from Portal.
After the next sync succeeds with the new key, disable the old key in AWS. Before removal, check document sets, agents, and Team shares. Remove the old IAM policy or key after the connector is no longer using it.