Amazon S3

S3 has no management-plane split: listing buckets and reading objects are ordinary requests signed with the same credentials. A machine that already works with the AWS CLI needs nothing more.

Ways to connect

• Use what this machine already has. Settings → Sign-ins → Amazon Web Services walks the credential chain below and says who it signed in as, and through what. When the chain finds nothing, the pane offers the rest:

• Sign in with a profile. A profile that needs a person — an SSO sign-in, or a role with an MFA code — is listed with its own Sign in or Assume role button.

• Paste a key ID and secret, or drop the accessKeys.csv AWS hands you when you create an access key. The key is checked before it is kept, and a kept key is used as it is, ahead of the chain.

• Install the AWS CLI, when it is missing: the pane shows the install command to copy.

The profile is AWS_PROFILE, falling back to default. No region to set: a bucket in another region says its own, and the app goes there.

The credential chain

The app walks one ordered list and takes the first source that answers:

	Source	Read from
1	Environment	AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN
2	Assumed role	the profile's role_arn with source_profile or credential_source, MFA if set
3	SSO	the profile's sso_session (or sso_start_url), account and role
4	Credentials file	~/.aws/credentials [profile]
5	Config file	keys written in the profile in ~/.aws/config
6	Assume-role cache	the newest live entry in ~/.aws/cli/cache
7	credential_process	the helper named in ~/.aws/config — aws-vault, granted, saml2aws
8	Web identity token	AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN, traded at STS
9	Container role	AWS_CONTAINER_CREDENTIALS_FULL_URI / _RELATIVE_URI on ECS
10	Instance role	the EC2 instance's role, unless AWS_EC2_METADATA_DISABLED=true
11	AWS CLI	aws configure export-credentials, when aws is installed

Credentials that expire are fetched again five minutes before they do. What was checked in the pane lists every source: one that is not set up on this machine shows as skipped rather than failed, so the list says which step is missing.

SSO

The app signs in to IAM Identity Center itself, by device code: click Sign in, approve the code in the browser page that opens, and the pane goes on. The token is kept where the AWS CLI keeps it, so aws sso login in a terminal signs the app in, and the app's sign-in signs the CLI in. It is refreshed while the session allows. A profile that names no account or role lists the accounts and roles the sign-in reaches.

MFA

A role whose profile has mfa_serial asks for the code: type it next to the profile and click Assume role. The session is kept in the CLI's cache until shortly before it expires.

Revoke

Revoke forgets a pasted key, or signs an SSO session out. Credentials that come from elsewhere — the environment, aws configure — are not the app's to change: the pane says where they come from.

Next: Google Cloud Storage.