> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/environment/storages/adding-an-aws-s3-bucket-for-storage.md).
# Adding an AWS S3 Bucket for Storage
{% hint style="success" %}
#### Required User Credentials
\[**Flosum User**] - **SystemAdministrator** Role
{% endhint %}
## Overview
By default, Flosum Backup & Archive stores data in a Flosum-managed AWS S3 bucket. However, customers may optionally use their own AWS S3 bucket for data storage. This guide explains how to configure your Flosum tenant to use a customer-managed AWS S3 bucket instead. Be sure to follow the IAM policy and security best practices outlined in the following section to ensure safe and compliant data operations.
* [#aws-s3-required-apis-and-policies](#aws-s3-required-apis-and-policies "mention")
## Adding AWS Bucket
{% stepper %}
{% step %}
### Access Global Settings
1. From any **Flosum Cloud App**, click the **App Switcher** icon at the top of the left sidebar menu.
2. Click **Global Settings**.
3. The **Global Settings** app will open in a new tab.
{% hint style="info" %}
Global Settings can also be accessed by logging in directly via the Flosum Cloud Apps Login URL. See the following article for login instructions.
* [Log In To Global Settings](/global-settings/getting-started/log-in-to-global-settings.md)
{% endhint %}
{% endstep %}
{% step %}
### Create Storage
1. Click **Storages** from the sidebar menu.
2. Click **Create Storage**.
{% endstep %}
{% step %}
### Select Storage Type
1. Enter a meaningful name for the storage in the **Name** textbox.
2. Click the **Storage type** dropdown.
3. Select **AWS S3**.
{% endstep %}
{% step %}
### Provide AWS Credentials
Input the following fields for connecting to your AWS S3 bucket:
{% hint style="info" %}
Field locations in AWS may vary from those listed in the table. Use the table as a reference to help locate the appropriate fields.
{% endhint %}
| Field | AWS Field |
|---|
| Region | Amazon S3 > Buckets > AWS Region (Only include the Region and not the Region Name. For example, if your storage is in US East (N. Virginia) us-east-1, only enter us-east-1.) |
| Bucket Name | Amazon S3 > Buckets > Name |
| Access Key Id | The Access Key ID generated when the bucket was created. |
| Secret Access Key | The Secret Access Key generated when the bucket was created. |
{% endstep %}
{% step %}
### Create AWS S3 Bucket
1. Click the **Create** button to add the AWS S3 Bucket.
{% hint style="info" %}
If you receive an error when adding storage, verify you have the correct policies configured in AWS. See the following section for what APIs and Policies are needed for access by Flosum Backup & Archive.
* [#aws-s3-required-apis-and-policies](#aws-s3-required-apis-and-policies "mention")
{% endhint %}
2. Once added successfully, the AWS S3 Bucket will appear in the list of **Storages**.
{% endstep %}
{% endstepper %}
***
## AWS S3 Required APIs and Policies
The following S3 APIs are utilized for backup and restore operations:
{% hint style="info" %}
#### Security Best Practices
* Grant least privilege only to required APIs
* Restrict access to a specific bucket and KMS key
* Do **not** grant permissions to modify or delete the bucket itself
* Avoid overly broad wildcard access
* KMS actions should be limited to `GenerateDataKey` and `Decrypt`
{% endhint %}
| API Category | Actions |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Core Object Operations | s3:PutObject – Upload records and attachments
s3:GetObject – Download objects
s3:DeleteObject – Remove outdated backups
s3:ListBucket – List contents of directories
|
| Bucket Management | `s3:GetBucketLocation` – Identify region for operations |
| KMS Operations (Encrypted Buckets Only) | kms:GenerateDataKey – For encrypted uploads
kms:Decrypt – To decrypt objects during restoration
|
These permissions are required to:
1. Store Salesforce record backups as CSV
2. Store files/attachments as binary objects
3. Maintain referential integrity with MySQL
4. Perform backup file cleanup
5. Enable restore operations
6. Handle KMS-based encryption/decryption
### Recommended IAM Policy Document
{% hint style="warning" %}
Replace `${BucketName}` with the name of the S3 bucket.
{% endhint %}
{% code title="Recommended IAM Policy (JSON)" %}
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "FlosumBackupRestoreOperations",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::${BucketName}",
"arn:aws:s3:::${BucketName}/*"
]
},
{
"Sid": "FlosumKMSOperations",
"Effect": "Allow",
"Action": [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": [
"arn:aws:kms:us-east-2:148761667479:key/bdcb7f8c-afe1-4973-8714-08ea2355ea03"
]
}
]
}
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.flosum.com/global-settings/environment/storages/adding-an-aws-s3-bucket-for-storage.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
