stackgate.ai
All integrations

Amazon S3

Browse S3 buckets, list and download objects (including Cypress videos), upload files, and manage keys via MCP.

Manual setup 7 tools

Overview

Connect Amazon S3 so AI clients can browse buckets, list objects by prefix, download files (including Cypress videos and build artifacts), upload objects, and copy or delete keys.

This integration uses the Amazon S3 API with IAM access keys stored encrypted in stackgate.ai. Usage is billed to your AWS account.

For build-scoped artifact access tied to a CodeBuild run ID, use the AWS CodeBuild integration instead.

Prerequisites

  • An AWS account with one or more S3 buckets you want AI clients to access
  • A stackgate.ai account

Getting credentials

  1. In the AWS IAM console, create an IAM user (or use an existing automation user) with programmatic access.
  2. Attach a least-privilege policy. Example for a single bucket:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": ["s3:ListBucket"],
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
        },
        {
            "Effect": "Allow",
            "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
        }
    ]
}

For KMS-encrypted objects, also grant kms:Decrypt and kms:GenerateDataKey on the relevant KMS key.

  1. Create an access key and copy the key ID and secret.
  2. In stackgate.ai, open My Integrations → Amazon S3.
  3. Click Activate and enter access key ID, secret access key, AWS region, and optionally a default S3 bucket name.

Using with AI clients

  • Dedicated endpoint: POST /mcp/s3 with a Sanctum bearer token
  • Private gateway: one config for all integrations — use s3__* namespaced tools

Typical workflow:

  1. list_buckets — discover bucket names (or rely on default bucket)
  2. list_objects — browse a prefix (suffix: .mp4 for Cypress videos)
  3. head_object — check size and content-type before downloading
  4. get_object — presigned_url for large files, temp_storage for cross-tool handoff, or inline for small text
  5. put_object / delete_object / copy_object — mutate objects when needed

See Documentation for HTTP authentication and private gateway setup.

Troubleshooting

  • 422 integration not configured — complete all required credential fields in My Integrations.
  • 403 / AccessDenied from AWS — verify IAM policy includes separate s3:ListBucket on the bucket ARN and object actions on arn:aws:s3:::bucket/*.
  • bucket is required — pass bucket or set a default bucket in My Integrations.
  • Object too large for inline — use output_mode=presigned_url or temp_storage on get_object.
  • KMS errors — add KMS decrypt/generate permissions for SSE-KMS buckets.
  • Temp Storage handoff — when using output_mode=temp_storage, files follow Temp Storage retention (see privacy policy).

Available tools

  • list_buckets

    List S3 buckets in the connected AWS account.

  • list_objects

    List objects in an S3 bucket by prefix. Filter by suffix (e.g. .mp4 for Cypress videos).

  • head_object

    Get object metadata (size, content-type, etag) without downloading the body.

  • get_object

    Download an S3 object. Use presigned_url for large files, temp_storage for cross handoff, or inline for small text.

  • put_object

    Upload an object to S3. Provide body (UTF-8 text) or body_base64 for binary content.

  • delete_object

    Delete an object from S3. This is destructive — confirm with the user first.

  • copy_object

    Copy an S3 object to a new key, within the same bucket or to another bucket.

MCP endpoint: https://stackgate.ai/mcp/s3 (HTTP) or via the private gateway.

Related workflows

Multi-integration playbooks that use Amazon S3 to solve concrete business outcomes.

Create account Documentation