← All support articles

Storage

Connect Amazon S3 storage

Connect a bucket in your AWS account so Flo can ingest objects via EventBridge without long-lived access keys.

Prerequisites

  • Org admin access in Flo
  • An S3 bucket in your AWS account
  • Permission to deploy CloudFormation or create IAM roles and EventBridge rules in that account

How to use

1. Add an S3 connector

  1. Go to Settings → Connectors.
  2. Click Add Connector.
  3. Select Amazon S3.

2. Configure the bucket

Enter:

  • Bucket name and AWS region (must match where the bucket lives)
  • Prefix (optional). Add one or more folder paths to monitor; leave empty for the whole bucket
  • Monitor subfolders. When enabled, events under each selected prefix are included

Use one connector per bucket. Add each required prefix on that connector (do not create a second connector for the same bucket).

3. Choose IAM Role authentication

For production and cross-account setups, select IAM Role (recommended).

Click Create connector. Flo provisions a dedicated ingest queue and sets the connector status to Pending until your AWS-side setup is complete.

4. Deploy in your AWS account

  1. Download the CloudFormation template from the success modal or connector card.
  2. Deploy the stack in the AWS account where your bucket lives.

The template creates:

  • An IAM role Flo can assume (with your connector’s external ID)
  • EventBridge rules for object create events
  • S3 → EventBridge notification on your bucket

You may deploy via CloudFormation or create equivalent IAM, EventBridge, and S3 notification resources manually. Flo verifies access, not how you built it.

5. Complete setup in Flo

  1. Copy the Role ARN from your deployed stack.
  2. Open the connector and paste the Role ARN into the edit flow.
  3. Save the connector.

6. Verify

  1. Confirm the connector card shows Active (green).
  2. Click Test connection. It should report success.
  3. Upload a test file under your configured prefix in S3.
  4. Open Assets and confirm the file appears after processing completes.

Optional: open Ingest status on the connector card to review queue health and pipeline steps.

Access key mode (development only)

Access key authentication is available for same-account development and testing. Do not use access keys in production. Use IAM role assumption instead.

Troubleshooting

Symptom Likely cause Fix
Test connection fails: access denied Wrong Role ARN, trust policy, external ID, or bucket policy Re-deploy CloudFormation or fix IAM; verify external ID matches connector ID
Connector stuck in Pending Stack not deployed or Role ARN not saved Deploy stack, paste Role ARN, re-test
Files uploaded but no asset Wrong prefix scope Upload under the configured prefix; check prefix filter
DLQ growth with healthy permissions Flo platform issue Contact contact@flomenco.com
Cross-region issues Bucket region mismatch Set connector region to match bucket region