Skip to content
Merulan

S3-compatible object store setup

What an operator supplies to connect the S3-compatible object store Source, and the verification the provider requires.

Connecting S3-compatible object store accepts an endpoint, a bucket, and a key pair. Merulan holds the credential directly. An operator who holds the material below connects in one pass.

Prerequisites

S3-compatible object store refuses the connection until every item holds.

  • A bucket on Amazon S3 or another store that answers the same requests.
  • The endpoint address for a store that is not Amazon S3, and the region name the store expects.
  • A key pair whose policy allows listing the bucket and reading objects under the chosen prefix.

Credentials

S3-compatible object store stores the credential under the direct custody the registry declares, so Merulan never shows the secret again once the connection is saved.

  • An access key identifier and a secret access key, with the region and the bucket, and an endpoint address and prefix when the store needs them.

Scopes

S3-compatible object store requests the scopes the registry declares, and a grant missing one of them fails the first collection read.

  • s3:ListBucket
  • s3:GetObject

The two actions above are what the adapter calls, so a policy granting anything wider grants more than the Source uses.

Verification

Workspace-issued credential governs the S3-compatible object store connection. The customer issues the key pair in their own account, so no application review stands between the key pair and production data.

  • Connect and map a Source runs the connect ceremony and binds collections once the credential is in hand.
  • Integrations lists every Source that carries a setup page, with its ceremony and verification posture.