S3-compatible storage

Explore 6 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.

With S3-compatible storage, a hire can:

• list your buckets, and the folders and files in them,
• find files by name (every word you give must be in the file's path),
• read a file as text: text files (txt, md, csv, json, code…), and Word, Excel, PowerPoint and OpenDocument files, which Roster turns into text itself. Of a large text file it reads the start. Other files (PDFs, images, archives) show their name, size and date only, never their content.

If you allow changes, a hire can also:

• upload text as a file (a report, a CSV). It never overwrites a file: replacing one asks a person first.
• make a download link that works for up to 7 days. Anyone holding the link can download the file until it ends, so this always asks a person first.
• delete a file. This always asks a person first. Unless the bucket keeps versions, a deleted file is gone.

Hires never see your keys. Passwords and keys written inside files are hidden from hires when they read them.

It works with Amazon S3, MinIO, Cloudflare R2, Wasabi, Ceph, Backblaze B2 and anything else that speaks the S3 API.

1. Make a key for RosterCopy Anchor Link

For Amazon S3, straight there: IAM users → the user made for Roster → Security credentials → Create access key. For R2, MinIO, Wasabi or Ceph, make an access key in their console.

Make a key that can reach only the buckets hires should use, and for read-only use, only read.

• Amazon S3: in IAM, create a user for Roster with a policy allowing s3:ListBucket and s3:GetObject on those buckets (add s3:PutObject and s3:DeleteObject to allow changes; s3:ListAllMyBuckets to list buckets). Create an access key for it.
• Cloudflare R2: R2 → Manage API tokens → Create API token, with Object Read only (or Object Read & Write) on the buckets. Copy the access key ID, secret, and the S3 endpoint https://<account id>.r2.cloudflarestorage.com.
• MinIO: in the console, Access Keys → Create access key, with a policy limited to the buckets.
• Wasabi, Ceph, others: create an access key in their console or with radosgw-admin; the endpoint is in their docs.

2. Connect it in RosterCopy Anchor Link

1. Open Integrations → Tools → Add a tool, search for S3 and choose S3-compatible storage.
2. Endpoint: leave it empty for Amazon S3. Otherwise your store's address, like https://minio.example.com:9000.
3. Region: your buckets' region (like eu-west-1); auto for Cloudflare R2; for MinIO, us-east-1 unless you set another.
4. Paste the Access key ID and Secret access key.
5. What hires may do: Find and read files, or also upload, share and delete.
6. Addressing can stay Automatic. If your store wants bucket names in the host name, choose virtual-hosted style.

Roster checks the key when you click Connect. Once it's accepted, the connection shows Connected as the store's owner (or address) and how many buckets the key can list. If it's refused, Roster says what to fix (a mistyped key, a missing permission) and saves nothing.

3. Give hires accessCopy Anchor Link

On the hire's Tools tab, click Give access on S3-compatible storage. Read only gives the reading tools; Read and write adds upload, links and delete (if the connection allows changes).

• Buckets and folders: the buckets, or folders in them as bucket/folder, the hire may use. Everything under them counts. Leave it empty for every bucket the key can reach.

Paths look like /reports/2026/q3.md: the bucket, then the folders and the file.

When it asks firstCopy Anchor Link

You can change this per hire on the hire's Tools tab, under When it asks first.

If something goes wrongCopy Anchor Link

• "The key isn't allowed this": the key's policy doesn't cover that bucket or action.
• Nothing found: S3 has no search of its own, so Roster looks through file names under the hire's folders (up to 5,000 files). Narrow the search with a folder.
• A file isn't read: PDFs, images and old Office formats (.doc, .xls) aren't read as text. Office files over 15 MB aren't either.
• Errors about the signature or region: check the region, and for MinIO and Ceph try the other addressing style.

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "text": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "words to look for"
    },
    "folder": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "a folder's path, like /Clients"
    },
    "limit": {
      "default": 20,
      "type": "integer",
      "minimum": 1,
      "maximum": 50
    }
  },
  "required": [
    "text"
  ]
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "folder": {
      "description": "a folder (path); leave out for the top",
      "type": "string",
      "minLength": 1,
      "maxLength": 1024
    },
    "limit": {
      "default": 50,
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "the file's path, like /Clients/notes.md (from list_folder or search_files)"
    }
  },
  "required": [
    "file"
  ]
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "folder": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "a folder's path, like /Clients"
    },
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "the file's name with its extension, like summary.md or rates.csv"
    },
    "text": {
      "type": "string",
      "maxLength": 1000000,
      "description": "the file's whole content, as text"
    },
    "replace": {
      "default": false,
      "description": "replace a file of the same name (asks a person first)",
      "type": "boolean"
    }
  },
  "required": [
    "folder",
    "name",
    "text"
  ]
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "the file's path, like /Clients/notes.md (from list_folder or search_files)"
    },
    "audience": {
      "default": "anyone",
      "description": "anyone with the link, or only people signed in to the organisation",
      "type": "string",
      "enum": [
        "anyone"
      ]
    },
    "expires_in_days": {
      "default": 1,
      "description": "when the link stops working",
      "type": "integer",
      "minimum": 1,
      "maximum": 7
    }
  },
  "required": [
    "file"
  ]
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "the file's path, like /Clients/notes.md (from list_folder or search_files)"
    }
  },
  "required": [
    "file"
  ]
}