> For the complete documentation index, see [llms.txt](https://docs.codemash.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.codemash.io/cloud/files/integrations/providers/aws-s3.md).

# AWS S3

Connect an AWS S3 bucket as a Files integration.

> Store your project's files in an Amazon S3 bucket you own.

*Last updated 2026-09-11 · Applies to all projects*

**Where:** Files → Integrations → **Add New Integration** → AWS S3 · `/projects/<project>/files/integrations/new/aws-s3`

## Why it exists

Amazon S3 is the storage most teams already run on: cheap, durable, and close to the rest of their infrastructure. Connecting your own bucket means the files stay in your AWS account, under your retention and billing rules, while Norbix handles who is allowed to read and write them.

## When you'd use it

* Your application already runs on AWS and files should live beside it.
* Compliance requires the data to stay in an account and region you control.
* You want S3 lifecycle rules (archive to Glacier, expire after N days) applied to your project's files.

## Where to find it

Files → **Integrations** → **Add New Integration** → **AWS S3**.

<figure><img src="https://760328771-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LwSkuCpTNI_AerL8J2a%2Fuploads%2Fgit-blob-a049cb8f114a610eae2befe0e4860ad0d3c8b202%2Ffiles-new-aws-s3.png?alt=media" alt="The New AWS S3 Integration form"><figcaption><p>Files → Integrations → Add New Integration → AWS S3.</p></figcaption></figure>

## Walkthrough video

{% hint style="warning" %}
Video **required, not recorded yet.** The documentation standard asks for one whenever setup leaves the Norbix screen, and this one goes into the AWS console: bucket, policy, bucket CORS, then a role or an IAM user. A screen recording of a real AWS account is needed; the Playwright suite cannot produce it.
{% endhint %}

## How to set it up

You need `files:create` on `files:integration:all` in Norbix, and permission in AWS to create an IAM policy plus either a role or a user.

Pick one of two ways to connect. **Cross-Account Role is recommended** — there is no long-lived secret to store or rotate.

### Option A — Cross-Account Role (recommended)

The form is a wizard; it walks you through the AWS side and then asks for the result.

1. **Bucket name** — the bucket that will hold the files, for example `my-bucket-name`.
2. **Bucket region** — pick the region the bucket is in, for example `eu-central-1`. It must match, or every call fails with a redirect error.
3. **Create AWS Policy** — the wizard shows a ready-made policy document. Copy it and create the policy in the AWS console.
4. **Save policy**, then **Configure bucket CORS** — apply the CORS rules the wizard shows, so browser uploads are allowed. Press **Next**.
5. **Create Role** and **Attach policy** — create an IAM role that trusts Norbix, attach the policy from step 3, and save it. Press **Next**.
6. **Role ARN** — paste the role's ARN, for example `arn:aws:iam::288698027899:role/norbix-files-access-role`.
7. **External ID** — the wizard supplies this value; it is what makes the trust relationship specific to your project. Leave it as shown.
8. Press **Test**, then **Save**.

### Option B — IAM user

Use this when you cannot create a role.

1. **Bucket name** — for example `my-bucket-name`.
2. **Bucket region** — for example `eu-central-1`.
3. **Create AWS Policy** → **Save policy** → **Configure bucket CORS**, then press **Next** (same as above).
4. **Create IAM user**, **Attach policy**, **Save user**, then **Download credentials**. Press **Next**.
5. **Access key** — the key id from the downloaded credentials, for example `AKIAY3YGCVYXWCLQOBLE`.
6. **Secret access key** — the matching secret, for example `iQxvLSRIdVgMcZ4h4HTRM0KDl4yXBYMR0P7DMoua`.
7. Press **Test**, then **Save**.

**What "working" looks like:** **Test** reports success, the integration appears in the list as **Enabled**, and the [Browser](/cloud/files/browser.md) can list the bucket's folders (empty is fine for a new bucket).

## Good to know

* **The region must match the bucket.** A wrong region is the most common cause of a failing test.
* **CORS is not optional.** The dashboard and your browser clients upload directly to S3, so without the CORS rules the upload step fails even though the credentials are correct.
* **Secrets are write-only.** Re-opening the form shows the bucket and region filled in and the secret fields empty. Leave them empty to keep the stored values.
* **Prefer the role.** An IAM user's access key lives in Norbix until you rotate it; a cross-account role has nothing to leak.
* Deleting the integration does not delete the bucket or its contents.

## Do it in code

Create or update this integration with **Save Files Integration**, using the S3 body shape:

{% tabs %}
{% tab title="JavaScript / TypeScript" %}

```ts
import { Norbix } from '@norbix.ai/ts';
const norbix = new Norbix();

await norbix.hub.files.saveFilesIntegration({
  name: 'Production files',
  provider: 'AwsS3',
  integration: {
    bucketName: 'my-bucket-name',
    region: 'eu-central-1',
    accessKey: 'AKIAY3YGCVYXWCLQOBLE',
    secretKey: '<your-secret-access-key>',
  },
});
```

{% endtab %}

{% tab title=".NET" %}

```csharp
using Norbix.Sdk;

using var client = new NorbixClient();

await client.Files.SaveFilesIntegrationAsync(new SaveFilesIntegrationRequest
{
    Name = "Production files",
    Provider = "AwsS3",
    // provider-specific body: bucketName, region, accessKey, secretKey
});
```

{% endtab %}

{% tab title="Python" %}

```python
from norbix_python import NorbixHub

norbix = NorbixHub()

norbix.files.save_files_integration(
    name="Production files",
    provider="AwsS3",
    integration={
        "bucketName": "my-bucket-name",
        "region": "eu-central-1",
        "accessKey": "AKIAY3YGCVYXWCLQOBLE",
        "secretKey": "<your-secret-access-key>",
    },
)
```

{% endtab %}

{% tab title="Go" %}

```go
c, _ := norbix.New(norbix.Options{})
ctx := context.Background()

var result map[string]any
_ = c.Hub.Files.SaveFilesIntegration(ctx, map[string]any{
	"name":     "Production files",
	"provider": "AwsS3",
	"integration": map[string]any{
		"bucketName": "my-bucket-name",
		"region":     "eu-central-1",
	},
}, &result)
```

{% endtab %}
{% endtabs %}

**CLI:** the Norbix CLI covers files themselves (`norbix files list`, `info`, `download`, `upload`, `sign`, `delete`) but has no command for the module or its integrations. Use an SDK or the API for those.

Method page: [Save Files Integration](/sdks-and-cli/files/integrations/save-files-integration.md)

## API reference

Endpoints: [Save Files Integration](/api-reference/files/integrations/save-files-integration.md) · [Files → Integrations](/api-reference/files/integrations.md).

## Related

[Providers](/cloud/files/integrations/providers.md) · [Azure Blob Storage](/cloud/files/integrations/providers/azure-blob.md) · [Google Cloud Storage](/cloud/files/integrations/providers/google-cloud.md) · [Integrations](/cloud/files/integrations.md)