Cloud

aws_s3

Downloads objects within an Amazon S3 bucket, optionally filtered by a prefix, either by walking the items in the bucket or by streaming upload notifications in real time.

Common
Advanced

input:
  label: ""
  aws_s3:
    bucket: ""
    prefix: ""
    scanner:
      to_the_end: {}
    sqs:
      url: ""
      key_path: Records.*.s3.object.key
      bucket_path: Records.*.s3.bucket.name
      envelope_path: ""
      nack_visibility_timeout: 0

input:
  label: ""
  aws_s3:
    bucket: ""
    prefix: ""
    region: "" # No default (optional)
    endpoint: "" # No default (optional)
    tcp:
      connect_timeout: 0s
      keep_alive:
        idle: 15s
        interval: 15s
        count: 9
      tcp_user_timeout: 0s
    credentials:
      profile: "" # No default (optional)
      id: "" # No default (optional)
      secret: "" # No default (optional)
      token: "" # No default (optional)
      from_ec2_role: false # No default (optional)
      role: "" # No default (optional)
      role_external_id: "" # No default (optional)
    force_path_style_urls: false
    delete_objects: false
    scanner:
      to_the_end: {}
    sqs:
      url: ""
      endpoint: ""
      key_path: Records.*.s3.object.key
      bucket_path: Records.*.s3.bucket.name
      envelope_path: ""
      delay_period: ""
      max_messages: 10
      wait_time_seconds: 0
      nack_visibility_timeout: 0
      zero_key_warn_interval: 30s

Stream objects on upload with SQS

A common pattern for consuming S3 objects is to emit upload notification events from the bucket either directly to an SQS queue, or to an SNS topic that is consumed by an SQS queue, and then have your consumer listen for events that prompt it to download the newly uploaded objects. More information about this pattern and how to set it up can be found in the Amazon S3 docs.

Redpanda Connect is able to follow this pattern when you configure an sqs.url, where it consumes events from SQS and downloads only the object keys contained in those events. For this to work, Redpanda Connect needs to know where within the event the key and bucket names can be found, specified as dot paths with the fields sqs.key_path and sqs.bucket_path. The default values for these fields should already be correct when following the guide above.

If your notification events are being routed to SQS via an SNS topic, the events are enveloped by SNS, in which case you also need to specify the field sqs.envelope_path, which in the case of SNS to SQS will usually be Message.

When using SQS, make sure you have sensible values for sqs.max_messages and also the visibility timeout of the queue itself. When Redpanda Connect consumes an S3 object the SQS message that triggered it is not deleted until the S3 object has been sent onwards. This ensures at-least-once crash resiliency, but also means that if the S3 object takes longer to process than the visibility timeout of your queue, then the same objects might be processed multiple times.

Download large files

When downloading large files, process them in streamed parts to avoid loading the entire file into memory at once. To do this, specify a scanner that determines how to break the input into smaller individual messages.

Bucket and prefix

The bucket field accepts a bucket name only, not an ARN. For example, use my-bucket, not arn:aws:s3:::my-bucket.

The prefix field accepts a single string. To consume from multiple prefixes in the same bucket, use multiple aws_s3 inputs in a broker input:

input:
  broker:
    inputs:
      - aws_s3:
          bucket: my-bucket
          prefix: logs/app1/
      - aws_s3:
          bucket: my-bucket
          prefix: logs/app2/

Credentials

By default, Redpanda Connect uses a shared credentials file when connecting to AWS services. You can also set credentials explicitly at the component level to transfer data across accounts. You can find out more in AWS credentials.

S3-compatible storage

The endpoint and force_path_style_urls fields let you connect to S3-compatible storage services such as Cloudflare R2, MinIO, or DigitalOcean Spaces.

For Cloudflare R2, set endpoint to your account endpoint URL and enable force_path_style_urls:

input:
  aws_s3:
    bucket: r2-bucket
    endpoint: https://<account-id>.r2.cloudflarestorage.com
    force_path_style_urls: true
    region: auto
    credentials:
      id: <r2-access-key-id>
      secret: <r2-secret-access-key>

Find your account ID in the Cloudflare dashboard under R2 > Overview > Account Details. Generate API credentials under R2 > Manage R2 API Tokens.

Metadata

This input adds the following metadata fields to each message:

s3_key
s3_bucket
s3_last_modified_unix
s3_last_modified (RFC3339)
s3_content_type
s3_content_encoding
s3_version_id
All user defined metadata

You can access these metadata fields using function interpolation. Note that user defined metadata is case insensitive within AWS, and it is likely that the keys will be received in a capitalized form, if you wish to make them consistent you can map all metadata keys to lower or uppercase using a Bloblang mapping such as meta = meta().map_each_key(key → key.lowercase()).

Fields

`bucket`

The name of the bucket to consume from, such as my-bucket. Use the bucket name, not its ARN. If the field sqs.url is specified this field is optional.

Type: string

Default: ""

`credentials`

Manually configure the AWS credentials to use (optional). For more information, see the Amazon Web Services guide.

Type: object

`credentials.from_ec2_role`

Use the credentials of a host EC2 machine configured to assume an IAM role associated with the instance.

Type: bool

`credentials.id`

The ID of the AWS credentials to use.

Type: string

`credentials.profile`

The profile from ~/.aws/credentials to use.

Type: string

`credentials.role`

The ARN of the role to assume.

Type: string

`credentials.role_external_id`

An external ID to use when assuming a role.

Type: string

`credentials.secret`

The secret for the AWS credentials in use.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration.

Type: string

`credentials.token`

The token for the AWS credentials in use. Required only when using short-term credentials.

Type: string

`delete_objects`

Whether to delete each object from its S3 bucket after all of its messages are acknowledged successfully. Objects whose messages fail to process are left in the bucket.

Type: bool

Default: false

`endpoint`

A custom endpoint URL for AWS API requests. Use this to connect to AWS-compatible services or local testing environments instead of the standard AWS endpoints.

Type: string

`force_path_style_urls`

Forces the client API to use path style URLs for downloading keys, which is often required when connecting to custom endpoints.

Type: bool

Default: false

`prefix`

An optional path prefix, if set only objects with the prefix are consumed when walking a bucket. This field accepts a single prefix. To consume objects under several prefixes in the same bucket, use one aws_s3 input for each prefix in a broker input.

Type: string

Default: ""

`region`

The AWS region in which your resources are hosted.

Type: string

`scanner`

The scanner used to split the stream of bytes into individual messages. Scanners are useful for processing large data sources efficiently without holding the entire data set in memory. For example, the csv scanner processes individual rows in a CSV file without loading the entire file in memory.

Type: scanner

Default:

to_the_end: {}

`sqs`

Consume SQS messages in order to trigger key downloads.

Type: object

`sqs.bucket_path`

A dot path whereby the bucket name can be found in SQS messages.

Type: string

Default: Records.*.s3.bucket.name

`sqs.delay_period`

An optional period of time to wait from when a notification was originally sent to when the target key download is attempted.

Type: string

Default: ""

# Examples:
delay_period: 10s

# ---

delay_period: 5m

`sqs.endpoint`

A custom endpoint to use when connecting to SQS.

Type: string

Default: ""

`sqs.envelope_path`

A dot path of a field to extract an enveloped JSON payload for further extracting the key and bucket from SQS messages. This is specifically useful when subscribing an SQS queue to an SNS topic that receives bucket events.

Type: string

Default: ""

# Examples:
envelope_path: Message

`sqs.key_path`

A dot path whereby object keys are found in SQS messages.

Type: string

Default: Records.*.s3.object.key

`sqs.max_messages`

The maximum number of SQS messages to consume from each request.

Type: int

Default: 10

`sqs.nack_visibility_timeout`

Custom SQS Nack Visibility timeout in seconds. Default is 0

Type: int

Default: 0

`sqs.url`

An optional SQS URL to connect to. When specified this queue will control which objects are downloaded.

Type: string

Default: ""

`sqs.wait_time_seconds`

Whether to set the wait time. Enabling this activates long-polling. Valid values: 0 to 20.

Type: int

Default: 0

`sqs.zero_key_warn_interval`

A message from which no target key can be extracted (for example, due to a misconfigured key_path/bucket_path) is never deleted, so it’s redelivered and re-evaluated repeatedly until the underlying issue is fixed. This field limits how often that condition is logged as a warning, to avoid flooding the logs; every occurrence is still logged at debug level. Set to 0s to warn on every occurrence.

Type: string

Default: 30s

# Examples:
zero_key_warn_interval: 10s

# ---

zero_key_warn_interval: 0s

`tcp`

Configure TCP socket-level settings to optimize network performance and reliability. These low-level controls are useful for:

Unresponsive hosts: Set connect_timeout to limit how long a connection attempt can take (the default 0s sets no limit)
Long-lived connections: Configure keep_alive settings to detect and recover from stale connections
Unstable networks: Tune keep-alive probes to balance between quick failure detection and avoiding false positives
Linux systems with specific requirements: Use tcp_user_timeout (Linux 2.6.37+) to control data acknowledgment timeouts

Most users should keep the default values. Only modify these settings if you’re experiencing connection stability issues or have specific network requirements.

Type: object

`tcp.connect_timeout`

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

Type: string

Default: 0s

`tcp.keep_alive`

TCP keep-alive probe configuration.

Type: object

`tcp.keep_alive.count`

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

Type: int

Default: 9

`tcp.keep_alive.idle`

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

Type: string

Default: 15s

`tcp.keep_alive.interval`

Duration between keep-alive probes. Zero defaults to 15s.

Type: string

Default: 15s

`tcp.tcp_user_timeout`

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep_alive.idle must be greater than this value per RFC 5482. Zero disables.

Type: string

Default: 0s

Was this helpful?

group Ask in the community

mail Share your feedback

What do you think of this page?

Let us know more:

Let us contact you about your feedback:

aws_s3

Stream objects on upload with SQS

Download large files

Bucket and prefix

Credentials

S3-compatible storage

Metadata

Fields

bucket

credentials

credentials.from_ec2_role

credentials.id

credentials.profile

credentials.role

credentials.role_external_id

credentials.secret

credentials.token

delete_objects

endpoint

force_path_style_urls

prefix

region

scanner

sqs

sqs.bucket_path

sqs.delay_period

sqs.endpoint

sqs.envelope_path

sqs.key_path

sqs.max_messages

sqs.nack_visibility_timeout

sqs.url

sqs.wait_time_seconds

sqs.zero_key_warn_interval

tcp

tcp.connect_timeout

tcp.keep_alive

tcp.keep_alive.count

tcp.keep_alive.idle

tcp.keep_alive.interval

tcp.tcp_user_timeout

`bucket`

`credentials`

`credentials.from_ec2_role`

`credentials.id`

`credentials.profile`

`credentials.role`

`credentials.role_external_id`

`credentials.secret`

`credentials.token`

`delete_objects`

`endpoint`

`force_path_style_urls`

`prefix`

`region`

`scanner`

`sqs`

`sqs.bucket_path`

`sqs.delay_period`

`sqs.endpoint`

`sqs.envelope_path`

`sqs.key_path`

`sqs.max_messages`

`sqs.nack_visibility_timeout`

`sqs.url`

`sqs.wait_time_seconds`

`sqs.zero_key_warn_interval`

`tcp`

`tcp.connect_timeout`

`tcp.keep_alive`

`tcp.keep_alive.count`

`tcp.keep_alive.idle`

`tcp.keep_alive.interval`

`tcp.tcp_user_timeout`