# AWS S3

> Connect AWS S3 to BucketMate Web with access keys and the companion browser extension

Canonical: https://docs.bucketmate.app/web/providers/connect-aws-s3

BucketMate Web connects to AWS S3 with access key credentials from your browser. Make sure the companion browser extension is connected before testing the connection.

## Prerequisites

- AWS account
- Access Key ID and Secret Access Key
- S3 bucket access
- Region for the bucket you want to manage
- BucketMate browser extension

## Recommended IAM permissions

Start with the narrowest policy that matches your workflow. BucketMate Web features can require these S3 actions:

- `s3:ListAllMyBuckets` to load all buckets automatically
- `s3:ListBucket` to browse a bucket
- `s3:GetObject` to download, preview, and share files
- `s3:PutObject` to upload, create folders, rename, and move
- `s3:DeleteObject` to delete, rename, move, and empty buckets
- `s3:CreateBucket` to create buckets
- `s3:DeleteBucket` to delete empty buckets

If you do not allow `s3:ListAllMyBuckets`, enter bucket names in **Explicit Buckets**.

## Connection steps

1. Open BucketMate Web.
2. Confirm the extension bridge is connected.
3. Choose **Add Connection**.
4. Select **Amazon S3**.
5. Leave endpoint empty, or enter `https://s3.<region>.amazonaws.com`.
6. Enter the access key ID and secret access key.
7. Select the bucket region.
8. Add explicit bucket names if bucket listing is not allowed.
9. Use **Test Connection**.
10. Save the connection.

## Endpoint and region

AWS S3 usually works best with an empty endpoint and the correct region. Use a region-specific endpoint only when your setup requires it.

| Region | Endpoint |
| --- | --- |
| `us-east-1` | `https://s3.us-east-1.amazonaws.com` |
| `us-west-2` | `https://s3.us-west-2.amazonaws.com` |
| Custom AWS-compatible endpoint | Use the provider endpoint instead of AWS S3 |

## Common issues and fixes

### Extension is disconnected

Install or reconnect the companion browser extension, then test again.

### Endpoint and region mismatch

If the endpoint does not match the bucket region, AWS can return 301 PermanentRedirect errors. Fix by using the bucket's region-specific endpoint.

### Buckets do not load

If the credentials can access a bucket but cannot list all buckets, add bucket names in **Explicit Buckets**.

### Access denied on preview or download

Preview, download, and share-link creation need object read permission. Add `s3:GetObject` for the target bucket path.