AWS S3 integration

Overview

The AWS S3 tool provides full access to Amazon S3 cloud storage. It supports three resource types: Bucket (create, delete, getAll, search), File (copy, delete, download, getAll, upload), and Folder (create, delete, getAll). File download produces binary data attached to the output item. File upload reads binary data from an upstream item or accepts plain text content. Uses the @aws-sdk/client-s3 package for all S3 operations with automatic SigV4 signing.

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires AWS credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Bucket	bucket
File	file
Folder	folder

Operations

Operations for the bucket resource:

Operation	Value	Description
Create	create	Create a bucket
Delete	delete	Delete a bucket
Get Many	getAll	Get many buckets
Search	search	Search within a bucket

Operations for the file resource:

Operation	Value	Description
Copy	copy	Copy a file
Delete	delete	Delete a file
Download	download	Download a file
Get Many	getAll	Get many files
Upload	upload	Upload a file

Operations for the folder resource:

Operation	Value	Description
Create	create	Create a folder
Delete	delete	Delete a folder
Get Many	getAll	Get many folders

Parameters

Bucket: Create

Parameter	Type	Required	Default	Description
Bucket Name (name)	string	Yes	—	Bucket name (globally unique).
Additional Fields	collection	No	{}	Optional settings applied when the bucket is created.
— ACL	options	No	—	The canned ACL to apply to the bucket.
				Options: authenticatedRead, Private, publicRead, publicReadWrite
— Bucket Object Lock Enabled	boolean	No	false	Whether you want S3 Object Lock to be enabled for the new bucket.
— Grant Full Control	boolean	No	false	Whether to allow grantee the read, write, read ACP, and write ACP permissions on the bucket.
— Grant Read	boolean	No	false	Whether to allow grantee to list the objects in the bucket.
— Grant Read ACP	boolean	No	false	Whether to allow grantee to read the bucket ACL.
— Grant Write	boolean	No	false	Whether to allow grantee to create, overwrite, and delete any object in the bucket.
— Grant Write ACP	boolean	No	false	Whether to allow grantee to write the ACL for the applicable bucket.
— Region	string	No	—	Region you want to create the bucket in. By default uses the region from credentials.

Bucket: Delete

Parameter	Type	Required	Default	Description
Bucket Name (name)	string	Yes	—	Name of the AWS S3 bucket to delete.

Bucket: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Accepts 1–500. (shown when Return All is false)

Bucket: Search

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the bucket to search within.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Accepts 1–500. (shown when Return All is false)
Additional Fields	collection	No	{}	Optional settings for the search.
— Delimiter	string	No	—	A delimiter is a character you use to group keys.
— Encoding Type	options	No	—	Encoding type used by Amazon S3 to encode object keys in the response.
				Options: url
— Fetch Owner	boolean	No	false	Whether to return owner field with each key in the result.
— Prefix	string	No	—	Limits the response to keys that begin with the specified prefix.
— Requester Pays	boolean	No	false	Whether the requester will pay for requests and data transfer.
— Start After	string	No	—	StartAfter is where you want Amazon S3 to start listing from.

File: Copy

Parameter	Type	Required	Default	Description
Source Path	string	Yes	—	The name of the source bucket and key name, separated by a slash (/). Must start with /.
Destination Path	string	Yes	—	The name of the destination bucket and key name, separated by a slash (/).
Additional Fields	collection	No	{}	Optional settings applied to the copied object.
— ACL	options	No	private	The canned ACL to apply to the object.
				Options: authenticatedRead, awsExecRead, bucketOwnerFullControl, bucketOwnerRead, private, publicRead, publicReadWrite
— Grant Full Control	boolean	No	false	Whether to give the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
— Grant Read	boolean	No	false	Whether to allow grantee to read the object data and its metadata.
— Grant Read ACP	boolean	No	false	Whether to allow grantee to read the object ACL.
— Grant Write ACP	boolean	No	false	Whether to allow grantee to write the ACL for the applicable object.
— Lock Legal Hold	boolean	No	false	Whether a legal hold will be applied to this object.
— Lock Mode	options	No	—	The Object Lock mode that you want to apply to this object.
				Options: governance, compliance
— Lock Retain Until Date	dateTime	No	—	The date and time when you want this object’s Object Lock to expire.
— Metadata Directive	options	No	—	Specifies whether the metadata is copied from the source or replaced.
				Options: copy, replace
— Requester Pays	boolean	No	false	Whether the requester will pay for requests and data transfer.
— Server Side Encryption	options	No	—	The server-side encryption algorithm used when storing this object.
				Options: AES256, aws:kms
— Server Side Encryption AWS KMS Key ID	string	No	—	KMS key ID when using aws:kms encryption.
— Server Side Encryption Context	string	No	—	Specifies the AWS KMS Encryption Context.
— Server Side Encryption Customer Algorithm	string	No	—	Specifies the algorithm to use when encrypting the object (e.g., AES256).
— Server Side Encryption Customer Key	string	No	—	Specifies the customer-provided encryption key.
— Server Side Encryption Customer Key MD5	string	No	—	Specifies the 128-bit MD5 digest of the encryption key.
— Storage Class	options	No	standard	Amazon S3 storage classes.
				Options: deepArchive, glacier, intelligentTiering, onezoneIA, standard, standardIA
— Tagging Directive	options	No	—	Specifies whether the object tag-set is copied from the source or replaced.
				Options: copy, replace

File: Delete

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
File Key	string	Yes	—	Object key to delete.
Options	collection	No	{}	Optional settings for the delete.
— Version ID	string	No	—	Specific version to delete.

File: Download

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
File Key	string	Yes	—	Object key to download.
Binary Property	string	Yes	data	Name of the output binary field to put the file in. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.

File: Get Many

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Accepts 1–500. (shown when Return All is false)
Options	collection	No	{}	Optional settings for the listing.
— Fetch Owner	boolean	No	false	Whether to return owner field with each key in the result.
— Folder Key	string	No	—	Prefix to filter by folder. NOTE: file getAll uses Delimiter=”/” so it returns only the current folder level (non-recursive). For a recursive search across the bucket, use the bucket “search” operation instead.

File: Upload

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
Binary File	boolean	No	true	Whether the data to upload should be taken from binary field.
Input Binary Field	string	Yes	data	The name of the input binary field containing the file to be uploaded. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use. (shown when Binary File is true)
File Name	string	No	—	If not set the binary data filename will be used. (shown when Binary File is true)
File Name	string	Yes	—	Key name for the uploaded object. (shown when Binary File is false)
File Content	string	No	—	The text content of the file to upload. (shown when Binary File is false)
Additional Fields	collection	No	{}	Optional settings applied to the uploaded object.
— ACL	options	No	private	The canned ACL to apply to the object.
				Options: authenticatedRead, awsExecRead, bucketOwnerFullControl, bucketOwnerRead, private, publicRead, publicReadWrite
— Grant Full Control	boolean	No	false	Whether to give the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
— Grant Read	boolean	No	false	Whether to allow grantee to read the object data and its metadata.
— Grant Read ACP	boolean	No	false	Whether to allow grantee to read the object ACL.
— Grant Write ACP	boolean	No	false	Whether to allow grantee to write the ACL for the applicable object.
— Lock Legal Hold	boolean	No	false	Whether a legal hold will be applied to this object.
— Lock Mode	options	No	—	The Object Lock mode that you want to apply to this object.
				Options: governance, compliance
— Lock Retain Until Date	dateTime	No	—	The date and time when you want this object’s Object Lock to expire.
— Parent Folder Key	string	No	—	Parent folder you want to create the file in.
— Requester Pays	boolean	No	false	Whether the requester will pay for requests and data transfer.
— Server Side Encryption	options	No	—	The server-side encryption algorithm used when storing this object.
				Options: AES256, aws:kms
— Server Side Encryption AWS KMS Key ID	string	No	—	KMS key ID when using aws:kms encryption.
— Server Side Encryption Context	string	No	—	Specifies the AWS KMS Encryption Context.
— Server Side Encryption Customer Algorithm	string	No	—	Specifies the algorithm to use when encrypting the object.
— Server Side Encryption Customer Key	string	No	—	Specifies the customer-provided encryption key.
— Server Side Encryption Customer Key MD5	string	No	—	Specifies the 128-bit MD5 digest of the encryption key.
— Storage Class	options	No	standard	Amazon S3 storage classes.
				Options: deepArchive, glacier, intelligentTiering, onezoneIA, standard, standardIA
Tags	fixedCollection	No	{}	Tags to apply to the uploaded object.
— Key	string	No	—	The tag name.
— Value	string	No	—	The tag value.

Folder: Create

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
Folder Name	string	Yes	—	Name of the folder to create.
Additional Fields	collection	No	{}	Optional settings applied when the folder is created.
— Parent Folder Key	string	No	—	Parent folder you want to create the folder in.
— Requester Pays	boolean	No	false	Whether the requester will pay for requests and data transfer.
— Storage Class	options	No	standard	Amazon S3 storage classes.
				Options: deepArchive, glacier, intelligentTiering, onezoneIA, RecudedRedundancy (Reduced Redundancy), standard, standardIA

Folder: Delete

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
Folder Key	string	Yes	—	Folder key prefix (e.g., “my-folder/”).

Folder: Get Many

Parameter	Type	Required	Default	Description
Bucket Name (bucketName)	string	Yes	—	Name of the S3 bucket.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Accepts 1–500. (shown when Return All is false)
Options	collection	No	{}	Optional settings for the listing.
— Fetch Owner	boolean	No	false	Whether to return owner field with each key in the result.
— Folder Key	string	No	—	Parent folder prefix to list within.

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently. Accepts 1–100.

Output Data

Results are merged onto the input item’s JSON, so the properties you started with remain available. Binary data on the input item is forwarded, and download adds the file to it.

Resource / Operation	Output
Bucket create, Bucket delete, File delete	One item per input item, carrying success: true.
Bucket getAll	Fans out — one item per bucket, carrying Name and CreationDate.
Bucket search	Fans out — one item per object, carrying Key, LastModified, ETag, Size, StorageClass, plus Owner when Fetch Owner is on.
File copy	One item per input item, carrying LastModified and ETag for the new copy.
File download	One item per input item, carrying fileKey, bucketName, contentType and contentLength, with the file attached as binary.
File getAll	Fans out — one item per object, carrying Key, LastModified, ETag, Size, StorageClass, plus Owner when Fetch Owner is on. Folder markers are filtered out.
File upload	One item per input item, carrying success: true, key and bucket. A binary upload also carries ETag and multipart, which is true when the file was sent as a multipart upload.
Folder create	One item per input item, carrying success: true.
Folder delete	One item per input item, carrying deleted — an array of { "Key": … } for every object removed under the prefix.
Folder getAll	Fans out — one item per folder marker found under the prefix.

When a listing returns nothing, the node still emits one item so the branch does not go silent. That item carries an empty array under a key naming what was listed — buckets, results, files or folders:

{
  "files": []
}

Downloads. The file’s bytes are attached to the output item under the binary property you name in Binary Property (default data), which is what a downstream node such as Knowledge Base or Write to File reads. contentLength and contentType describe the object as S3 reported it.

Uploads. With Binary File on, the node takes the bytes from the named input binary property and, unless you set File Name, reuses that property’s own file name as the S3 key. With Binary File off, it writes the text in File Content to the key in File Name. In both cases Parent Folder Key is prefixed to the key.

Reference results downstream by expression, e.g. {{ $json.Key }} or {{ $json.ETag }}.

Example Configuration

Create a private bucket in a named region:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "bucket",
    "operation": "create",
    "name": "my-workflow-bucket",
    "additionalFields": {
      "acl": "Private",
      "region": "us-east-1"
    }
  }
}

List every bucket the credentials can see:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "bucket",
    "operation": "getAll",
    "returnAll": true
  }
}

Search a bucket recursively under a prefix:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "bucket",
    "operation": "search",
    "bucketName": "my-workflow-bucket",
    "returnAll": false,
    "limit": 200,
    "additionalFields": {
      "prefix": "invoices/2026/",
      "fetchOwner": true
    }
  }
}

Download an object into the data binary property:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "file",
    "operation": "download",
    "bucketName": "my-workflow-bucket",
    "fileKey": "{{ $json.Key }}",
    "binaryPropertyName": "data"
  }
}

Upload a binary file from an upstream node, encrypted and tagged:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "file",
    "operation": "upload",
    "bucketName": "my-workflow-bucket",
    "binaryData": true,
    "binaryPropertyName": "data",
    "fileName": "reports/{{ $json.reportId }}.pdf",
    "additionalFields": {
      "acl": "private",
      "storageClass": "standardIA",
      "serverSideEncryption": "AES256"
    },
    "tagsUi": {
      "tagsValues": [
        { "key": "source", "value": "workflow" },
        { "key": "retention", "value": "90d" }
      ]
    }
  }
}

Upload plain text without any binary input:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "file",
    "operation": "upload",
    "bucketName": "my-workflow-bucket",
    "binaryData": false,
    "fileName": "notes.txt",
    "fileContent": "{{ $json.summary }}",
    "additionalFields": {
      "parentFolderKey": "daily"
    }
  }
}

List the objects at one folder level:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "file",
    "operation": "getAll",
    "bucketName": "my-workflow-bucket",
    "returnAll": true,
    "options": {
      "folderKey": "invoices/"
    }
  }
}

Copy an object between buckets, replacing its metadata:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "file",
    "operation": "copy",
    "sourcePath": "/source-bucket/{{ $json.Key }}",
    "destinationPath": "/archive-bucket/{{ $json.Key }}",
    "additionalFields": {
      "acl": "private",
      "storageClass": "glacier",
      "metadataDirective": "replace"
    }
  }
}

Delete one object, then a whole folder:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "file",
    "operation": "delete",
    "bucketName": "my-workflow-bucket",
    "fileKey": "{{ $json.Key }}"
  }
}

{
  "type": "aws_s3",
  "parameters": {
    "resource": "folder",
    "operation": "delete",
    "bucketName": "my-workflow-bucket",
    "folderKey": "temp/"
  }
}

Create a folder and list the folders under a prefix:

{
  "type": "aws_s3",
  "parameters": {
    "resource": "folder",
    "operation": "create",
    "bucketName": "my-workflow-bucket",
    "folderName": "{{ $json.year }}",
    "additionalFields": {
      "parentFolderKey": "invoices",
      "storageClass": "standard"
    }
  }
}

{
  "type": "aws_s3",
  "parameters": {
    "resource": "folder",
    "operation": "getAll",
    "bucketName": "my-workflow-bucket",
    "returnAll": true,
    "options": {
      "folderKey": "invoices/"
    }
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

AWS S3 manages buckets, files and folders in Amazon S3 and S3-compatible object storage. It is the right tool when a workflow must upload, download, copy, list or delete objects, or create and delete buckets and folders, rather than work with files on local disk or another cloud drive. It returns object and bucket metadata as JSON items, a downloaded file attached as binary data, and getAll paging through large listings.