--- title: AWS S3 actions source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/aws/aws-s3 --- This page provides a reference for AWS S3 actions available in the workflow automation actions catalog. Use these actions to list, retrieve, upload, and delete objects in Amazon S3 buckets. ## Prerequisites Before using AWS actions in workflow automation, ensure you have: - An AWS account with appropriate permissions. - AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials). - The necessary IAM permissions for the specific AWS services you plan to use. See [Set up AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions. ## List objects in a bucket The action identifier is `aws.s3.listObjectsV2`. Returns some or all (up to 1,000) of the objects in a bucket with their metadata. It is the recommended version of `listObjects`. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ------------------------------------------------------------------------------ | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region of the target bucket. | `us-east-2` | | `bucket` | String | Required. Name of the S3 bucket to list objects from. | `examplebucket` | | `prefix` | String | Optional. Limits the response to keys that begin with this prefix. | `path/to/folder/` | | `maxKeys` | Integer | Optional. Maximum number of keys to return (up to 1,000). | `100` | | `continuationToken` | String | Optional. Token from a previous response to retrieve the next page of results. | `some-token` | | `parameters` | Map | Optional. Additional boto3 parameters to pass to the API call. | `{"Delimiter": "/"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | Additional optional boto3 fields (`EncodingType`, `FetchOwner`, `StartAfter`, `RequestPayer`, `ExpectedBucketOwner`, `OptionalObjectAttributes`, `Delimiter`) are available via the `parameters` input. See the [list_objects_v2 boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/list_objects_v2.html) for details. The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | See the [list_objects_v2 boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/list_objects_v2.html). | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"Parameter validation failed: Invalid bucket name"` | **Example workflow** ```yaml name: aws-s3-list-objects-v2 description: 'List Objects in an AWS S3 Bucket' steps: - name: aws_s3_listObjectsV2_1 type: action action: aws.s3.listObjectsV2 version: '1' inputs: awsRoleArn: "arn:aws:iam::123456789012:role/my-workflow-role" region: "us-east-2" bucket: "examplebucket" prefix: "path/to/folder/" maxKeys: 100 next: end ``` ## Delete an object from a bucket The action identifier is `aws.s3.deleteObject`. Permanently removes a single object from a bucket. For versioned buckets, this operation inserts a delete marker, which hides the object without permanently deleting it unless a `VersionId` is specified. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | --------------------------------------------------------------------------- | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region of the target bucket. | `us-east-2` | | `bucket` | String | Required. Name of the S3 bucket containing the object. | `examplebucket` | | `key` | String | Required. Full key (path) of the object to delete. | `path/to/object.txt` | | `parameters` | Map | Optional. Additional boto3 parameters to pass to the API call. | `{"VersionId": "testVersion", "MFA": "Test"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | Additional optional boto3 fields (`RequestPayer`, `BypassGovernanceRetention`, `ExpectedBucketOwner`, `IfMatch`, `VersionId`, `MFA`) are available via the `parameters` input. See the [delete_object boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/delete_object.html) for details. The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | See the [delete_object boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/delete_object.html). | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"Parameter validation failed: Invalid bucket name"` | **Example workflow** ```yaml name: aws-s3-delete-object description: 'Delete an AWS S3 Object' steps: - name: aws_s3_deleteObject_1 type: action action: aws.s3.deleteObject version: '1' inputs: awsRoleArn: "arn:aws:iam::123456789012:role/my-workflow-role" region: "us-west-2" bucket: "my-bucket" key: "path/to/object.txt" next: end ``` ## Add an object to a bucket The action identifier is `aws.s3.putObject`. Adds an object to a bucket. Amazon S3 is a distributed system — if it receives multiple write requests for the same object simultaneously, it overwrites all but the last object written. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region of the target bucket. | `us-east-2` | | `bucket` | String | Required. Name of the S3 bucket to upload the object to. | `examplebucket` | | `key` | String | Required. Full key (path) for the object in the bucket. | `path/to/object.txt` | | `body` | String | Required. The object data to upload. | `file content` | | `contentType` | String | Required. Standard MIME type of the object. | `plain/text` | | `tagging` | String | Optional. URL-encoded tag set to apply to the object. | `key1=value1` | | `parameters` | Map | Optional. Additional boto3 parameters to pass to the API call. | `{"ServerSideEncryption": "AES256", "Metadata": {"metadata1": "value1"}}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | Additional optional boto3 fields are available via the `parameters` input. See the [put_object boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/put_object.html) for the complete list. The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | See the [put_object boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/put_object.html). | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"An error occurred (NoSuchBucket) when calling the PutObject operation: The specified bucket does not exist"` | **Example workflow** ```yaml name: s3-put-object description: 'Put an AWS S3 Object' steps: - name: aws_s3_putObject_1 type: action action: aws.s3.putObject version: '1' inputs: awsRoleArn: "arn:aws:iam::123456789012:role/my-workflow-role" region: "us-east-2" bucket: "examplebucket" key: "path/to/object.txt" body: "Hello world" contentType: "plain/text" tagging: "key1=value1" next: end ``` ## Retrieve an object from a bucket The action identifier is `aws.s3.getObject`. Retrieves an object from Amazon S3. Specify the full key name for the object in the request. > #### ⚠️ IMPORTANT > > This action fails if the object is larger than 100 KB. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region of the target bucket. | `us-east-2` | | `bucket` | String | Required. Name of the S3 bucket containing the object. | `examplebucket` | | `key` | String | Required. Full key (path) of the object to retrieve. | `path/to/object.txt` | | `versionId` | String | Optional. Version ID of the object to retrieve. If omitted, the current version is returned. | `some-version-id` | | `range` | String | Optional. HTTP range header to retrieve a specific byte range of the object. | `bytes=0-99` | | `parameters` | Map | Optional. Additional boto3 parameters to pass to the API call. | `{"ChecksumMode": "ENABLED"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | Additional optional boto3 fields are available via the `parameters` input. See the [get_object boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/get_object.html) for the complete list. The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | See the [get_object boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3/client/get_object.html). | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"An error occurred (InvalidArgument) when calling the GetObject operation: Invalid version id specified"` | **Example workflow** ```yaml name: s3-get-object description: 'Get an AWS S3 Object' steps: - name: aws_s3_getObject_1 type: action action: aws.s3.getObject version: '1' inputs: awsRoleArn: "arn:aws:iam::123456789012:role/my-workflow-role" region: "us-east-2" bucket: "examplebucket" key: "path/to/object.txt" next: end ```