BucketDeskWhat are the BucketDesk workspace bucket requirements?
See what you need to connect an S3 bucket to BucketDesk: bucket details, scoped IAM access, KMS permissions and optional capabilities.
Prepare the bucket details, a scoped IAM role and any required KMS permissions. Add upload or AI access only when the plan and AWS configuration support those actions, then verify the connection before inviting the team.
To connect an S3 bucket to a BucketDesk workspace, you need an AWS bucket you control or are authorized to connect, its AWS account and Region details, and an IAM role BucketDesk can assume. You can restrict that connection to an approved prefix rather than exposing every object in the bucket.
An AWS administrator handles the connection setup. Colleagues then sign in to BucketDesk to use the files available to their workspace.
What should you prepare before connecting?
Start by deciding which files the workspace needs. For example, a team working only with client documents can connect an approved client-documents/ prefix instead of the bucket root. Record the bucket name and Region exactly as they appear in AWS.
BucketDesk’s connection form validates bucket names using a 3–63 character format. Supplying a name is only the first check: the connection must also verify access to the real bucket and selected scope.
- The AWS account containing the bucket
- The bucket name and AWS Region
- The approved prefix, if access should be limited to one area
- An administrator able to create or update the required IAM role
- The KMS key details if the selected objects use a customer-managed key
What changes for KMS-encrypted files?
Reading objects encrypted with a customer-managed AWS KMS key requires the applicable decrypt permission and a key policy that permits the access. A successful bucket listing does not prove the connection can decrypt every object.
Test a representative file encrypted with the key you actually use. If folders appear but previews fail, check object permissions and KMS authorization separately.
Are uploads and document AI part of the same setup?
Optional capabilities require their own permissions and an eligible plan. In the current BucketDesk configuration, uploads and document AI are Ultra capabilities. Document AI also requires an enabled AI connection and its Bedrock role; read-only storage access alone is insufficient.
Enabling a capability in BucketDesk does not itself apply the corresponding AWS permissions. Follow the connection’s setup or update flow, then verify the connection again.
Does every bucket need versioning or Object Lock?
Basic browsing does not require you to enable Object Lock. Versioning is relevant when you want older object versions and recovery options; Object Lock adds retention protection to selected versions. Choose those controls for your storage requirements rather than treating them as interchangeable setup switches.
Work with your S3 files in BucketDesk
Connect the smallest useful scope, verify access with a sample file, and expand capabilities as your workflow needs them. BucketDesk supports browsing and core previews on the Minimum plan.
How BucketDesk connects through customer-owned CloudFormationIAM roles and external IDs explained
Minimum is free. Deploy a scoped role with CloudFormation, sign in, and browse, without handing anyone an access key.
Primary sources
Discussion
0 comments · open to guests · moderatedLiked this? Get the next article by email. No schedule, no filler, one click to leave.