Amazon S3 Toolkit
The Amazon S3 toolkit lets agents list buckets and objects, upload text or files, read and delete objects, copy objects, create buckets, read metadata, and generate presigned download URLs. Authentication uses an AWS access key ID and secret (IAM). It also works with S3-compatible endpoints (MinIO, DigitalOcean Spaces, Backblaze B2, and similar).
Add it on the agent Toolkits tab and create or select an S3 connection with your credentials.
Prerequisites
- An IAM user or access key with permission for the buckets the agent should use
- An agent you can edit
- Optional: default bucket, region, and custom endpoint for S3-compatible stores
Setup
- Create an IAM access key with the least privilege needed (or a custom policy instead of full S3 access).
- Open the agent → Toolkits → add Amazon S3.
- Create a connection with:
- Access key ID and Secret access key (required)
- Optional default bucket, region (default
us-east-1), and endpoint for compatible APIs
- Save the agent.
@-mention S3 tools in the personality prompt for file storage tasks.
Available tools
| Tool | Description |
|---|---|
| List Buckets | Lists buckets available to the credentials. |
| Create Bucket | Creates a bucket (names must be globally unique on AWS). |
| List Objects | Lists objects in a bucket (optional prefix). |
| Upload Text | Uploads a text object. |
| Upload File | Uploads a file object. |
| Read File | Reads object content. |
| Delete File | Deletes an object. |
| Get File Metadata | Returns object metadata. |
| Copy Object | Copies an object within or across buckets (per credentials). |
| Generate Presigned URL | Creates a time-limited download URL (default 1 hour, max 7 days). |
Bucket can come from connection defaults or be passed per call.
Use cases
- Store generated reports or exports in a known bucket prefix
- Read a config or data file from S3 during a workflow
- Share a short-lived download link with a presigned URL
- Copy objects between prefixes during cleanup or promotion
Tips
- Prefer a default bucket in the connection to avoid repeating it in every call.
- Use a custom endpoint + region for MinIO or other compatible stores.
- Presigned URLs expire — keep TTL as short as practical.
- Store keys in a saved connection — do not put secrets in the personality prompt.
Troubleshooting
| Symptom | What to check |
|---|---|
| Access Denied | IAM policy, bucket policy, and correct access key |
| NoSuchBucket / wrong region | Bucket name and region (or endpoint for compatible APIs) |
| Presigned URL fails | Clock skew, expiry, and object key spelling |
| Compatible endpoint errors | Endpoint URL, path-style vs virtual-hosted, and SSL settings |