Skip to main content

​
Credentials

The S3 VFS needs an AWS access key pair with read (and optionally write) access to your bucket.

​
1. Create an IAM User

  1. Go to https://console.aws.amazon.com/iam/
  2. Users -> Create user
  3. Attach the AmazonS3ReadOnlyAccess policy (or AmazonS3FullAccess for write)
  4. Security credentials -> Create access key -> Application running outside AWS
  5. Copy the Access key ID and Secret access key

​
2. Set Environment Variables

​
Alternative: AWS Profile

If you have ~/.aws/credentials configured, you can use a profile name instead of explicit access keys. For the Python VFS API, see the S3 VFS doc.

​
Scoping a VFS to a key prefix

Both runtimes support a key prefix option that transparently scopes every operation to a subpath of the bucket, so agents see clean paths while the underlying S3 keys carry the full prefix.
Leading slashes are stripped and a trailing slash is added automatically. None / undefined and empty strings both mean “no prefix.” For browser security considerations, see the TypeScript S3 setup doc.

​
Content type of uploads

A write carries no content type of its own, so the mount decides what S3 stores and serves back. Set default_content_type (defaultContentType in TypeScript) to stamp every upload with it. Unset, S3 picks its own default, and the browser’s presigned PUT, which has to sign a type, sends application/octet-stream.