Connect

aws_s3

Uploads messages to an Amazon S3 bucket as objects, using the path specified in the path field.

Introduced in version 3.36.0.

Common
Advanced

output:
  label: ""
  aws_s3:
    bucket: "" # No default (required)
    path: ${!counter()}-${!timestamp_unix_nano()}.txt
    tags: {}
    content_type: application/octet-stream
    metadata:
      exclude_prefixes: []
    max_in_flight: 64
    batching:
      count: 0
      byte_size: 0
      period: ""
      check: ""

output:
  label: ""
  aws_s3:
    bucket: "" # No default (required)
    path: ${!counter()}-${!timestamp_unix_nano()}.txt
    tags: {}
    content_type: application/octet-stream
    content_encoding: ""
    cache_control: ""
    content_disposition: ""
    content_language: ""
    website_redirect_location: ""
    metadata:
      exclude_prefixes: []
    storage_class: STANDARD
    kms_key_id: ""
    checksum_algorithm: ""
    server_side_encryption: ""
    force_path_style_urls: false
    max_in_flight: 64
    timeout: 5s
    object_canned_acl: ""
    batching:
      count: 0
      byte_size: 0
      period: ""
      check: ""
      processors: [] # No default (optional)
    region: "" # No default (optional)
    endpoint: "" # No default (optional)
    tcp:
      connect_timeout: 0s
      keep_alive:
        idle: 15s
        interval: 15s
        count: 9
      tcp_user_timeout: 0s
    credentials:
      profile: "" # No default (optional)
      id: "" # No default (optional)
      secret: "" # No default (optional)
      token: "" # No default (optional)
      from_ec2_role: false # No default (optional)
      role: "" # No default (optional)
      role_external_id: "" # No default (optional)

To use a different path for each object, use function interpolation, which is evaluated for each message in a batch.

Metadata

Metadata fields on messages will be sent as headers, in order to mutate these values (or remove them) check out the metadata docs.

Credentials

By default, Redpanda Connect uses a shared credentials file when connecting to AWS services. You can also set credentials explicitly at the component level to transfer data across accounts. You can find out more in AWS credentials.

Batching

It’s common to want to upload messages to S3 as batched archives. The easiest way to do this is to batch your messages at the output level and join the batch of messages with an archive or compress processor.

For example, the following configuration uploads messages as a .tar.gz archive of documents:

output:
  aws_s3:
    bucket: TODO
    path: ${!counter()}-${!timestamp_unix_nano()}.tar.gz
    batching:
      count: 100
      period: 10s
      processors:
        - archive:
            format: tar
        - compress:
            algorithm: gzip

This configuration uploads JSON documents as a single large document containing an array of objects:

output:
  aws_s3:
    bucket: TODO
    path: ${!counter()}-${!timestamp_unix_nano()}.json
    batching:
      count: 100
      processors:
        - archive:
            format: json_array

Bucket name format

The bucket field accepts a bucket name only, not an ARN. For example, use my-bucket, not arn:aws:s3:::my-bucket.

S3-compatible storage

The endpoint and force_path_style_urls fields let you connect to S3-compatible storage services such as Cloudflare R2, MinIO, or DigitalOcean Spaces.

For Cloudflare R2, set endpoint to your account endpoint URL and enable force_path_style_urls:

output:
  aws_s3:
    bucket: r2-bucket
    path: ${!uuid_v4()}.json
    endpoint: https://<account-id>.r2.cloudflarestorage.com
    force_path_style_urls: true
    region: auto
    credentials:
      id: <r2-access-key-id>
      secret: <r2-secret-access-key>

Find your account ID in the Cloudflare dashboard under R2 > Overview > Account Details. Generate API credentials under R2 > Manage R2 API Tokens.

Performance

This output benefits from sending multiple messages in flight in parallel for improved performance. You can tune the max number of in flight messages (or message batches) with the field max_in_flight.

Fields

`batching`

Configure a batching policy.

Type: object

# Examples:
batching:
  byte_size: 5000
  count: 0
  period: 1s

# ---

batching:
  count: 10
  period: 1s

# ---

batching:
  check: this.contains("END BATCH")
  count: 0
  period: 1m

`batching.byte_size`

The maximum total size (in bytes) that a batch can reach before it is flushed. When the combined size of all messages in the batch reaches or exceeds this limit, the batch is immediately sent to the next stage (such as a processor or output).

Set to 0 to disable size-based batching. When disabled, messages are flushed based on other conditions (such as count or period).

Type: int

Default: 0

`batching.check`

A Bloblang query that returns a boolean value indicating whether a message should end a batch.

Type: string

Default: ""

# Examples:
check: this.type == "end_of_transaction"

`batching.count`

The number of messages at which the batch is flushed. Set to 0 to disable count-based batching.

Type: int

Default: 0

`batching.period`

The length of time after which an incomplete batch is flushed regardless of its size. This field accepts Go duration format strings such as 100ms, 1s, or 5s. Supported time units are ns, us, ms, s, m, and h.

Type: string

Default: ""

# Examples:
period: 1s

# ---

period: 1m

# ---

period: 500ms

`batching.processors[]`

A list of processors to apply to a batch as it is flushed. This allows you to aggregate and archive the batch however you see fit. All resulting messages are flushed as a single batch, so splitting the batch into smaller batches with these processors has no effect.

Type: array<processor>

# Examples:
processors:
  - archive:
      format: concatenate


# ---

processors:
  - archive:
      format: lines


# ---

processors:
  - archive:
      format: json_array

`bucket`

The name of the bucket to upload messages to, such as my-bucket. Use the bucket name, not the bucket ARN.

Type: string

`cache_control`

The cache control to set for each object.

This field supports interpolation functions.

Type: string

Default: ""

`checksum_algorithm`

The algorithm used to create the checksum for each object, which Amazon S3 uses to validate the object during upload.

Requires version 4.38.0 or later.

Type: string

Default: ""

Options: CRC32, CRC32C, SHA1, SHA256

`content_disposition`

The content disposition to set for each object.

This field supports interpolation functions.

Type: string

Default: ""

`content_encoding`

An optional Content-Encoding value, such as gzip, to store with each uploaded S3 object. When empty, S3 stores the object without a content encoding.

This field supports interpolation functions.

Type: string

Default: ""

`content_language`

The content language to set for each object.

This field supports interpolation functions.

Type: string

Default: ""

`content_type`

The MIME type to store as the Content-Type of each uploaded S3 object.

This field supports interpolation functions.

Type: string

Default: application/octet-stream

`credentials`

Manually configure the AWS credentials to use (optional). For more information, see the Amazon Web Services guide.

Type: object

`credentials.from_ec2_role`

Use the credentials of a host EC2 machine configured to assume an IAM role associated with the instance.

Requires version 4.2.0 or later.

Type: bool

`credentials.id`

The ID of the AWS credentials to use.

Type: string

`credentials.profile`

The profile from ~/.aws/credentials to use.

Type: string

`credentials.role`

The ARN of the role to assume.

Type: string

`credentials.role_external_id`

An external ID to use when assuming a role.

Type: string

`credentials.secret`

The secret for the AWS credentials in use.

This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Secrets.

Type: string

`credentials.token`

The token for the AWS credentials in use. Required only when using short-term credentials.

Type: string

`endpoint`

A custom endpoint URL for AWS API requests. Use this to connect to AWS-compatible services or local testing environments instead of the standard AWS endpoints.

Type: string

`force_path_style_urls`

Forces the client API to use path style URLs, which helps when connecting to custom endpoints.

Type: bool

Default: false

`kms_key_id`

An optional server-side encryption key.

Type: string

Default: ""

`max_in_flight`

The maximum number of messages to have in flight at a given time. For outputs that send messages in batches, this limit applies to message batches. Increase this value to improve throughput.

Type: int

Default: 64

`metadata`

Specify which message metadata keys are stored as user-defined metadata on each S3 object, which S3 returns as x-amz-meta-* headers.

Type: object

`metadata.exclude_prefixes[]`

Provide a list of explicit metadata key prefixes to exclude when adding metadata to sent messages.

Type: array<string>

Default: []

`object_canned_acl`

The object canned ACL value. Leave empty to omit the ACL from upload requests, which is required for buckets that have ACLs disabled (the AWS default since 2023).

Requires version 4.56.0 or later.

Type: string

Default: ""

Options: "", private, public-read, public-read-write, authenticated-read, aws-exec-read, bucket-owner-read, bucket-owner-full-control

`path`

The path of each message to upload.

This field supports interpolation functions.

Type: string

Default: ${!counter()}-${!timestamp_unix_nano()}.txt

# Examples:
path: ${!counter()}-${!timestamp_unix_nano()}.txt

# ---

path: ${!meta("kafka_key")}.json

# ---

path: ${!json("doc.namespace")}/${!json("doc.id")}.json

`region`

The AWS region in which your resources are hosted.

Type: string

`server_side_encryption`

An optional server-side encryption algorithm.

Requires version 3.63.0 or later.

Type: string

Default: ""

`storage_class`

The storage class to set for each object.

This field supports interpolation functions.

Type: string

Default: STANDARD

Options: STANDARD, REDUCED_REDUNDANCY, GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE

`tags`

Key/value pairs to store with the object as tags.

This field supports interpolation functions.

Type: object<string>

Default: {}

# Examples:
tags:
  Key1: Value1
  Timestamp: ${!meta("Timestamp")}

`tcp`

Configure TCP socket-level settings to optimize network performance and reliability. These low-level controls are useful for:

Unresponsive hosts: Set connect_timeout to limit how long a connection attempt can take (the default 0s sets no limit)
Long-lived connections: Configure keep_alive settings to detect and recover from stale connections
Unstable networks: Tune keep-alive probes to balance between quick failure detection and avoiding false positives
Linux systems with specific requirements: Use tcp_user_timeout (Linux 2.6.37+) to control data acknowledgment timeouts

Most users should keep the default values. Only modify these settings if you’re experiencing connection stability issues or have specific network requirements.

Requires version 4.69.0 or later.

Type: object

`tcp.connect_timeout`

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

Type: string

Default: 0s

`tcp.keep_alive`

TCP keep-alive probe configuration.

Type: object

`tcp.keep_alive.count`

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

Type: int

Default: 9

`tcp.keep_alive.idle`

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

Type: string

Default: 15s

`tcp.keep_alive.interval`

Duration between keep-alive probes. Zero defaults to 15s.

Type: string

Default: 15s

`tcp.tcp_user_timeout`

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep_alive.idle must be greater than this value per RFC 5482. Zero disables.

Type: string

Default: 0s

`timeout`

The maximum period to wait for every object in a message batch to upload to S3. When the timeout is reached, the batch upload is abandoned and reattempted.

Type: string

Default: 5s

`website_redirect_location`

The website redirect location to set for each object.

This field supports interpolation functions.

Type: string

Default: ""

Was this helpful?

group Ask in the community

mail Share your feedback

What do you think of this page?

Let us know more:

Let us contact you about your feedback:

aws_s3

Metadata

Tags

Credentials

Batching

Bucket name format

S3-compatible storage

Performance

Fields

batching

batching.byte_size

batching.check

batching.count

batching.period

batching.processors[]

bucket

cache_control

checksum_algorithm

content_disposition

content_encoding

content_language

content_type

credentials

credentials.from_ec2_role

credentials.id

credentials.profile

credentials.role

credentials.role_external_id

credentials.secret

credentials.token

endpoint

force_path_style_urls

kms_key_id

max_in_flight

metadata

metadata.exclude_prefixes[]

object_canned_acl

path

region

server_side_encryption

storage_class

tags

tcp

tcp.connect_timeout

tcp.keep_alive

tcp.keep_alive.count

tcp.keep_alive.idle

tcp.keep_alive.interval

tcp.tcp_user_timeout

timeout

website_redirect_location

`batching`

`batching.byte_size`

`batching.check`

`batching.count`

`batching.period`

`batching.processors[]`

`bucket`

`cache_control`

`checksum_algorithm`

`content_disposition`

`content_encoding`

`content_language`

`content_type`

`credentials`

`credentials.from_ec2_role`

`credentials.id`

`credentials.profile`

`credentials.role`

`credentials.role_external_id`

`credentials.secret`

`credentials.token`

`endpoint`

`force_path_style_urls`

`kms_key_id`

`max_in_flight`

`metadata`

`metadata.exclude_prefixes[]`

`object_canned_acl`

`path`

`region`

`server_side_encryption`

`storage_class`

`tags`

`tcp`

`tcp.connect_timeout`

`tcp.keep_alive`

`tcp.keep_alive.count`

`tcp.keep_alive.idle`

`tcp.keep_alive.interval`

`tcp.tcp_user_timeout`

`timeout`

`website_redirect_location`