23  Amazon S3 Connector

Use this guide for an Amazon S3 connector. Nous indexes objects in the selected bucket and optional prefix.

23.1 What is indexed or searched live

The connector indexes supported objects that the AWS credential can list and read. A prefix limits the object key path. S3 object ACLs do not replace the Nous workspace and Team access rules.

23.2 Administrator role and authentication

An AWS administrator or IAM administrator should create a dedicated least- privilege integration identity. The customer creates the AWS access key and secret for the standard customer path. Never use a root access key.

The identity needs s3:ListBucket for the bucket and s3:GetObject for the selected objects. Add s3:GetBucketLocation when required by the AWS account policy.

23.3 Provider setup and permissions

Create an IAM policy limited to the target bucket and prefix. Create an IAM user access key for the customer connector. Store the secret once, in the connector credential form, and rotate it under the normal AWS key policy.

23.4 Setup form fields

Field What to enter
Name A unique workspace connector name.
Bucket Name The S3 bucket name, without s3://.
Prefix Optional object-key prefix, such as policies/2026/.
AWS Access Key ID The customer-created access key ID.
AWS Secret Access Key The matching secret.
Who has access Choose Everyone in the workspace or Specific Teams.

23.5 Workspace and Team access

AWS IAM controls what Nous can read. Nous access controls who can search the indexed result. Use Specific Teams for a limited audience. Portal manages Team membership. A Team share cannot grant access to an object outside the IAM policy.

23.6 Test the connection

  1. Save the connector and wait for source sync and search indexing.
  2. Confirm that a known object in the selected prefix appears.
  3. Search for a phrase from the object content.
  4. Test as an intended Workspace or Team member.

23.7 Common errors

Error Action
Access denied on list Add s3:ListBucket for the bucket and check the prefix condition.
Access denied on read Add s3:GetObject for the selected object path.
Bucket is not found Check the exact bucket name and AWS account.
Key is rejected Create a new access key, save it, test, then revoke the old key.

23.8 Reconnect, rotate, and remove

Create and test the replacement AWS access key before retiring the old one. Use Reconnect when the connector supports the action. Before removal, check document sets, agents, and Team shares. Remove the old IAM policy or key after the connector is no longer using it.

23.9 Official provider documentation