AWS S3

Connecting DASH to Amazon S3 writes a copy of each submitted certificate into an S3 bucket for long-term archival. You configure it as a Storage channel (CHANNEL-003) with the connector type S3 on the Material. The same connector works with S3-compatible stores (such as MinIO) when you supply a custom endpoint.

Before you start

• You need the Materials permission and an active (non-trial) subscription — see Roles & permissions.
• Ask your cloud/IT team for the bucket name, region, and an access key ID and secret access key for a user or role limited to writing into that bucket.
• The channel is configured inside a Material — open Materials and choose one, or create a Material first.

What you need from your cloud/IT team

Detail	Notes
Bucket name	The target S3 bucket
Region	The bucket’s AWS region, for example eu-west-2
Access key ID	The credential’s public identifier
Secret access key	The credential’s secret (masked as •••••••• after saving)
Endpoint (optional)	Only for S3-compatible stores; leave blank for AWS S3
Prefix / folder (optional)	A key prefix to group certificates within the bucket

Follow least-privilege: request keys that can only write to the one archival bucket, not your whole account.

Configure the S3 channel

1. Open the Material and go to the Data channels section.
2. Add a channel with direction Storage and connector type S3.
3. Name it clearly, for example S3 archive.
4. Enter the bucket name and region.
5. Enter the access key ID and secret access key.
6. For an S3-compatible store, add the custom endpoint; leave it blank for AWS S3. Add a prefix if you want certificates grouped in a folder.
7. Save the channel.

Storage is archival, not the destination

An S3 storage channel keeps a copy for your records — it does not replace the submission channel that delivers the certificate to its recipient. Add it alongside any submission channel on the same Material.

Test the connection

Use Test connection. DASH probes the bucket and reports:

• Pass — “S3 bucket <bucket> is accessible.”
• Fail — one of:
  • “No S3 bucket configured.” — the bucket field is empty.
  • “S3 bucket <bucket> not found.” — the name or region is wrong, or the bucket doesn’t exist.
  • “Access denied — check S3 access key and secret.” — the keys are wrong or lack permission.
  • “Could not reach S3 endpoint — check region/network.” — a network or region/endpoint problem.

Common pitfalls

• Region mismatch. A bucket exists in exactly one region. The wrong region reads as bucket not found — confirm the region with your cloud team.
• Insufficient key permissions. Access denied usually means the key can’t write to the bucket. Ask for a policy that allows object writes to your prefix.
• Custom endpoint left set for AWS. Only fill the endpoint for S3-compatible stores. For AWS S3, leave it blank.
• Secret shows as •••••••• when editing. Expected — leave the placeholder to keep the stored key; only overtype it to change it.
• A storage push failing does not fail the submission. Storage pushes are best-effort — the certificate still submits even if the S3 copy doesn’t land.

Related

• Storage channels
• Credentials & testing
• Veeva Vault
• Microsoft SharePoint
• Data channel troubleshooting