> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/datasets/adding-data/datasources/datasource-credentials/aws-s3.md).

# AWS S3 Credentials

Use this page when you want Roboflow to mirror an AWS S3 bucket through [Datasources](/datasets/adding-data/datasources.md).

{% hint style="warning" %}
For AWS S3, use Datasources and Bucket Mirror whenever you want ongoing sync, repeat imports, or metadata sidecar support. Do not build a presigned URL or local download workflow for that use case.
{% endhint %}

## Choose a Credential Type

Roboflow supports three AWS access patterns for S3 Datasources: [IAM credentials](#use-iam-access-keys), [Assume Role](#use-assume-role), and [bucket policy access](#use-a-bucket-policy-grant).

1. [**IAM credentials**](#use-iam-access-keys): the simplest setup path
2. [**Assume Role**](#use-assume-role): recommended for most teams
3. [**Bucket policy access**](#use-a-bucket-policy-grant): use this if your team wants to grant access directly at the bucket

Assume Role is the most secure default because it avoids long-lived AWS secrets.

### Security Guidelines

Before you create any credential:

1. Use a dedicated role or IAM identity for Roboflow.
2. Do not use the AWS account root user.
3. Scope access to the specific bucket whenever possible.
4. Prefer [Assume Role](/datasets/adding-data/datasources/datasource-policy-examples.md#assume-role-trust-policy) over long-lived access keys.
5. Store credentials only in Roboflow Workspace [Credentials](https://app.roboflow.com/settings/thirdpartykeys) or in your own secret manager.
6. Rotate access keys if you use them, and delete unused keys.

### Use Assume Role

**Recommended by Amazon**. No long-lived access keys are needed. Instead, create an IAM Role in your AWS account that Roboflow assumes to read your bucket.

1. Open the [IAM Roles console](https://console.aws.amazon.com/iam/home#/roles).
2. Create a new role in your AWS account.
3. In Roboflow, open [Credentials](https://app.roboflow.com/settings/thirdpartykeys), click [Add Credential](https://app.roboflow.com/settings/thirdpartykeys#create), and choose the "AWS Assume Role" credential type.
4. Copy the Roboflow AWS principal ARN and the External ID shown in the Create Credential modal.
5. Add the trust policy from [Datasource Policy Examples](/datasets/adding-data/datasources/datasource-policy-examples.md#assume-role-trust-policy) to the role, replacing the placeholders with the values from the modal.
6. Attach the bucket-scoped read policy from [Datasource Policy Examples](/datasets/adding-data/datasources/datasource-policy-examples.md#custom-iam-policy), or an equivalent least-privilege policy.
7. Copy the role ARN.
8. Paste the role ARN into the Roboflow credential form and save the credential.

The External ID is tied to your workspace and credential type, so reopening the modal shows the same value.

### Use IAM Access Keys

This is the simplest setup path but not recommended by Amazon.

1. Open the [IAM Users console](https://console.aws.amazon.com/iam/home#/users).
2. Create a dedicated IAM user for Roboflow.
3. Attach the AWS managed policy `AmazonS3ReadOnlyAccess`, or preferably the bucket-scoped policy in [Datasource Policy Examples](/datasets/adding-data/datasources/datasource-policy-examples.md#custom-iam-policy).
4. Create an access key for that user through the current AWS console flow.
5. Save the Access Key ID and Secret Access Key in a secure location.
6. In Roboflow, open [Credentials](https://app.roboflow.com/settings/thirdpartykeys), click [Add Credential](https://app.roboflow.com/settings/thirdpartykeys#create), and choose the "AWS IAM" credential type.
7. Enter the access key and secret key, and save the credential.

`AmazonS3ReadOnlyAccess` grants read access to all buckets in the account. If you want least-privilege access, use the custom bucket-scoped policy in [Datasource Policy Examples](/datasets/adding-data/datasources/datasource-policy-examples.md#custom-iam-policy).

### Use a Bucket Policy Grant

**For Enterprise customers only**. No IAM credentials are needed. Instead, add a bucket policy that grants Roboflow's AWS role read access directly.

1. Get the Roboflow AWS role ARN from your Roboflow representative.
2. Open the target S3 bucket policy in AWS.
3. Merge in the example from [Datasource Policy Examples](/datasets/adding-data/datasources/datasource-policy-examples.md#bucket-policy).
4. Confirm the policy only grants the minimum read access required for the bucket.
5. Create the corresponding credential in Roboflow if your workspace flow requires it.

Contact your Roboflow representative for the correct role ARN, and merge the example into your existing bucket policy if you already have one.

## Create the Credential in Roboflow

After you create the AWS-side access:

1. Go to [Credentials](https://app.roboflow.com/settings/thirdpartykeys#create) in Workspace settings.
2. Click [Add Credential](https://app.roboflow.com/settings/thirdpartykeys#create).
3. Choose the AWS S3 Datasource credential type.
4. Enter the role ARN or access key details, depending on the method you chose.
5. Save the credential.
6. Select that credential when you create the [Datasource](https://app.roboflow.com/settings/datasources#create).

## Next Step

After the credential is saved, continue with [Datasources](/datasets/adding-data/datasources.md) to configure bucket mirroring.