# S3 Object Storage

Source: https://docs.anaphora.it/delivery-interfaces/s3

# S3 Object Storage

Archive reports to S3-compatible object storage for long-term retention, compliance, and historical reference.

![S3 Object Storage delivery interface configuration showing access key, secret key, region, bucket name, and custom endpoint fields](images/s3.png)

## Use cases

| Scenario                 | Benefit                                        |
|--------------------------|------------------------------------------------|
| Compliance archiving     | Immutable records for audit requirements       |
| Historical reference     | "What did this dashboard look like on date X?" |
| Long-term retention      | Store beyond housekeeping limits               |
| Cross-system access      | Other tools can retrieve archived reports      |

## Configuration

| Field                 | Description                                 | Required |
|-----------------------|---------------------------------------------|----------|
| **Name**              | Interface identifier                        | Yes      |
| **Access key ID**     | AWS access key or S3-compatible credentials | Yes      |
| **Secret access key** | AWS secret key (stored encrypted)           | Yes      |
| **Region**            | AWS region (e.g., `eu-west-1`)              | No       |
| **Bucket name**       | Target S3 bucket                            | Yes      |
| **Custom endpoint**   | For S3-compatible storage (MinIO, etc.)     | No       |

## Provider configurations

### AWS S3

```
Access key ID: AKIAIOSFODNN7EXAMPLE
Secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Region: eu-west-1
Bucket name: my-reports-bucket
Custom endpoint: (leave empty)
```

### MinIO (self-hosted)

```
Access key ID: minioadmin
Secret access key: minioadmin
Region: us-east-1
Bucket name: anaphora-reports
Custom endpoint: https://minio.internal:9000
```

### DigitalOcean Spaces

```
Access key ID: DO00EXAMPLE
Secret access key: your-secret-key
Region: nyc3
Bucket name: my-space-name
Custom endpoint: https://nyc3.digitaloceanspaces.com
```

### Backblaze B2

```
Access key ID: your-key-id
Secret access key: your-application-key
Region: us-west-002
Bucket name: your-bucket
Custom endpoint: https://s3.us-west-002.backblazeb2.com
```

## IAM permissions

For AWS S3, the IAM user/role needs these permissions:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-reports-bucket",
        "arn:aws:s3:::my-reports-bucket/*"
      ]
    }
  ]
}
```

:::tip Least privilege
Anaphora only uploads files (`s3:PutObject`). For write-only archiving, you can remove `s3:GetObject` and
`s3:ListBucket`.
:::

## Testing

1. Configure the S3 interface with your credentials
2. Click **Test**
3. In **Test pdf**, click **Select pdf** and select a PDF file
4. Optionally, enter a **Test Key** (the object name, without `.pdf`)
5. Click **Upload to S3**
6. Make sure the file appears in your bucket

## Troubleshooting

| Issue                 | Solution                                         |
|-----------------------|--------------------------------------------------|
| Access Denied         | Verify IAM permissions, check bucket policy      |
| Invalid credentials   | Double-check access key and secret               |
| Bucket not found      | Verify bucket name and region match              |
| Connection timeout    | Check custom endpoint URL, verify network access |
| SSL certificate error | For self-signed certs, configure trust settings  |

## Best practices

### Security

- Use dedicated IAM credentials with minimal permissions
- Enable bucket versioning for compliance requirements
- Consider enabling server-side encryption (SSE-S3 or SSE-KMS)
- Restrict bucket access with bucket policies