Amazon S3

Overview

The Amazon S3 connector listens for object events from the buckets you choose and reads or writes objects with an IAM role in your account. Each event carries the bucket, key, size and ETag, and every file Tessel touches is listed in the trace of the run.

Teams use it to parse vendor CSVs as they land and load them into Snowflake, to copy signed contracts from Google Drive into an archive bucket and to post a Slack message when a nightly export is missing.

Supported setups

• General purpose buckets in any AWS region

• SSE-S3 and SSE-KMS encrypted objects, with kms:Decrypt on the role

• Prefix and suffix filters per trigger, such as invoices/ and .csv

How event delivery works

You turn on EventBridge notifications for the bucket, and a rule forwards matching events to Tessel's endpoint in your workspace region. Tessel checks each event against the schema and starts the workflow, then assumes your role to read the object.

{
  "source": ["aws.s3"],
  "detail-type": ["Object Created"],
  "detail": {
    "bucket": { "name": ["acme-vendor-drops"] },
    "object": { "key": [{ "prefix": "invoices/" }] }
  }
}

{
  "source": ["aws.s3"],
  "detail-type": ["Object Created"],
  "detail": {
    "bucket": { "name": ["acme-vendor-drops"] },
    "object": { "key": [{ "prefix": "invoices/" }] }
  }
}

{
  "source": ["aws.s3"],
  "detail-type": ["Object Created"],
  "detail": {
    "bucket": { "name": ["acme-vendor-drops"] },
    "object": { "key": [{ "prefix": "invoices/" }] }
  }
}

Large files

Objects over 100 MB are read in ranges and written with multipart upload, so a step never holds a whole file in memory. Writes use the run and step as part of the key, so a retry overwrites rather than duplicates.

Permissions needed

Create an IAM role that trusts Tessel's AWS account with your external ID. It needs read access to the buckets your triggers watch. Write access is only required on prefixes you write to.

• s3:GetObject and s3:ListBucket on watched buckets

• s3:PutObject only on prefixes a workflow writes to

• sts:AssumeRole trust with sts:ExternalId set to your workspace ID