> For the complete documentation index, see [llms.txt](https://developer.kizen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.kizen.com/docs/integrations-and-apps/integrations/amazon-s3/set-up-amazon-s3-in-kizen.md).

# Set Up Amazon S3 in Kizen

Learn how to configure the Amazon S3 integration in Kizen to work with live S3 data in Agentic Workflows.

{% hint style="success" %}
**Audience:** Admins, Developers, Solution Architects

**Purpose:** Explains how to configure the connection between Amazon S3 and <code class="expression">space.vars.Kizen\_company\_name</code>
{% endhint %}

## Overview

{% hint style="warning" %}
**Caution:** This setup reflects Kizen's default configuration. Your administrator may have customized your layout, so columns or navigation may appear differently. Trial accounts may have limited features.
{% endhint %}

Connect Amazon Simple Storage Service (S3) to <code class="expression">space.vars.Kizen\_company\_name</code> through the Amazon S3 integration.

***

## Before You Begin

To set up Amazon S3 in <code class="expression">space.vars.Kizen\_company\_name</code>, you need:

* Any standard Amazon Web Services (AWS) account with at least one active S3 bucket
* Org Admin access in <code class="expression">space.vars.Kizen\_company\_name</code>

***

## Set Up Amazon S3 in Kizen

To set up Amazon S3 in <code class="expression">space.vars.Kizen\_company\_name</code>:

{% stepper %}
{% step %}

#### Create an IAM policy

From the IAM Dashboard in the AWS Management Console, create a new IAM policy for your Amazon Web Services account. The IAM policy is a JSON object that determines the permissions to grant the integration:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::bucket_name"
    },
    {
      "Sid": "ReadWriteObjects",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::bucket_name/*"
    },
    {
      "Sid": "ReadOnlySourceBucket",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::source_bucket_name/*"
    }
  ]
}
```

The following table lists the permissions to grant depending on how you want to use the integration.

| Integration action     | IAM permissions                                                                      | Resource level to grant on                |
| ---------------------- | ------------------------------------------------------------------------------------ | ----------------------------------------- |
| Upload File            | `s3:PutObject`                                                                       | Object                                    |
| Get File Content       | `s3:GetObject`, `s3:GetObjectVersion`                                                | Object                                    |
| Get File Metadata      | `s3:GetObject`, `s3:ListBucket`                                                      | Object                                    |
| List Files             | `s3:ListBucket`                                                                      | Bucket                                    |
| Copy File              | `s3:GetObject` on the source and destination, `s3:PutObject` on the destination only | Object, source bucket, destination bucket |
| Generate Presigned URL | `s3:PutObject` for upload links, `s3:GetObject` for download links                   | Bucket                                    |

For more information on creating the IAM policy, see the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) and the [IAM JSON policy element reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html).
{% endstep %}

{% step %}

#### Create an IAM user

Also from the IAM Dashboard, create a new IAM user, and attach the permission policy that you created in [Step 1](#create-an-iam-policy). This user becomes the user of the integration.

For more information on creating the IAM user, see the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
{% endstep %}

{% step %}

#### Create an access key for the IAM user

From the summary page for the new IAM user, create an access key. Select the access key type for a third-party service, and note the values for the access key ID and secret access key. You need these values for the integration secret in [Step 6](#enter-your-amazon-s3-connection-credentials).

For more information on creating the access key, see the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
{% endstep %}

{% step %}

#### Go to the App Marketplace

In <code class="expression">space.vars.Kizen\_company\_name</code>, go to the global navigation, and select **Platform** > **App Marketplace**.

<div data-with-frame="true"><figure><img src="https://3898351136-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQd8ufpN7wkdnx7JtgoeZ%2Fuploads%2Ffzoos6vbr0prt7BbpKCy%2Fglobal_platformappmarketplace.png?alt=media&amp;token=98eabc11-f0ba-4a44-8bc2-e863201d234e" alt="The App Marketplace menu item under the Platform group in the global navigation" width="563"><figcaption></figcaption></figure></div>
{% endstep %}

{% step %}

#### Turn on the Amazon S3 integration

Find the Amazon S3 card, and turn on the integration.

<div data-with-frame="true"><figure><img src="https://3898351136-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQd8ufpN7wkdnx7JtgoeZ%2Fuploads%2FeOFLLS2H4iYo1pD5Cq0p%2Famazons3_appoff.png?alt=media&amp;token=79ccd5de-c802-4eaf-8c60-b1cc873880bd" alt="The Amazon S3 card in the App Marketplace" width="563"><figcaption></figcaption></figure></div>

The Update Integration Secret modal appears.

<div data-with-frame="true"><figure><img src="https://3898351136-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQd8ufpN7wkdnx7JtgoeZ%2Fuploads%2FvlrM9fJDDs0p12thU3LX%2Famazons3_updateintegrationsecret.png?alt=media&amp;token=6ed02a11-1f40-4820-855f-ac89559c56a9" alt="Update Integration Secret modal" width="563"><figcaption></figcaption></figure></div>

{% hint style="info" %}
**Note:** To access the Update Integration Secret modal after initial setup, find the active Amazon S3 card in the App Marketplace, select **Manage Secrets** on the card to open the Secret Manager in <code class="expression">space.vars.Kizen\_company\_name</code>, find the secret for the Amazon S3 integration, and select **Edit** from its action menu.
{% endhint %}
{% endstep %}

{% step %}

#### Enter your Amazon S3 connection credentials

In the Integration Secret field of the modal, enter your Amazon S3 connection credentials as a JSON object. The JSON object must contain `aws_access_key_id` and `aws_secret_access_key`, with the optional `region` key, nested within a tag that describes your S3 environment, like this:

```json
{
  "prod": {
    "aws_access_key_id": "AKIA...",
    "aws_secret_access_key": "...",
    "region": "us-east-2"
  }
}
```

Store multiple environments like this:

```json
{
  "prod": {
    "aws_access_key_id": "AKIA...",
    "aws_secret_access_key": "...",
    "region": "us-east-2"
  },
  "archive": {
    "aws_access_key_id": "AKIA...",
    "aws_secret_access_key": "...",
    "region": "us-east-2"
  }
}
```

For descriptions of the keys, see the following table:

| Key                     | Type     | Description                                                  | Required? |
| ----------------------- | -------- | ------------------------------------------------------------ | --------- |
| `aws_access_key_id`     | `String` | The AWS access key ID for your IAM user                      | Yes       |
| `aws_secret_access_key` | `String` | The AWS secret access key for your IAM user                  | Yes       |
| `region`                | `String` | The region code for the physical location of your AWS server | No        |

If you don't know the region of your server or the corresponding region code, you can find this information in the Amazon S3 Console. For more information, see the [Amazon Simple Storage Service documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points-directory-buckets-details.html).

{% hint style="info" %}
**Note:** ​<code class="expression">space.vars.Kizen\_company\_name</code> hides your secret once you submit it, so you can't append a new environment to an existing secret. You must re-enter the credentials for all your environments along with the new one. Consider keeping a secure record of each environment's connection details outside of <code class="expression">space.vars.Kizen\_company\_name</code> so you can refer to the full set whenever you add a new environment.
{% endhint %}
{% endstep %}

{% step %}

#### Save the integration secret

Select **Save**.
{% endstep %}
{% endstepper %}

***

## What's Next

Continue to [Work with Amazon S3 Files in an Agentic Workflow](/docs/integrations-and-apps/integrations/amazon-s3/work-with-amazon-s3-files-in-an-agentic-workflow.md) to learn how to include live S3 data in your <code class="expression">space.vars.automations</code>.

<details>

<summary><strong>Related Topics</strong></summary>

* [Amazon S3](/docs/integrations-and-apps/integrations/amazon-s3.md)
* [Work with Amazon S3 Files in an Agentic Workflow](/docs/integrations-and-apps/integrations/amazon-s3/work-with-amazon-s3-files-in-an-agentic-workflow.md)
* [Troubleshoot Amazon S3](/docs/integrations-and-apps/integrations/amazon-s3/troubleshoot-amazon-s3.md)

</details>

*Amazon Web Services, AWS, Amazon Simple Storage Service, and Amazon S3 are trademarks of Amazon.com, Inc. or its affiliates. Kizen's Amazon S3 integration is not affiliated with, sponsored by, or endorsed by Amazon.com, Inc.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://developer.kizen.com/docs/integrations-and-apps/integrations/amazon-s3/set-up-amazon-s3-in-kizen.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.