Amazon S3 export

Export Nimriz events as newline-terminated NDJSON objects in a customer-owned Amazon S3 bucket.

Availability: Amazon S3 setup is available on Enterprise plans.

Requirements

• An Enterprise plan.
• An S3 bucket and AWS region.
• An AWS access key limited to s3:PutObject for the destination prefix.

Create a scoped IAM policy

Replace the bucket and prefix in this example. If you leave the Nimriz prefix empty, grant access to the intended bucket path instead.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET/YOUR_PREFIX/*"
    }
  ]
}

Create credentials for the scoped IAM principal. Do not grant bucket administration, deletion, ACL, or public-access permissions unless your own storage policy independently requires them. AWS documents s3:PutObject in its S3 policy examples.

Connect Amazon S3 in Nimriz

1. Go to Integrations›Destinations›Browse catalog and choose Amazon S3.
2. Enter the Access key ID, Secret access key, Region, and Bucket.
3. Optionally enter a Prefix to isolate Nimriz objects.
4. On Review, confirm that the test will leave a sample object, then select Save, test, and enable.
5. Nimriz stores the credentials encrypted, saves the destination disabled, performs a real signed PutObject, and enables delivery only when that test succeeds.

If the provider test fails, the saved destination stays disabled. Correct the key or target, then select Retry test and enable.

Changing any credential, region, bucket, or prefix invalidates the previous test.

Object format and keys

Each object contains one JSON event followed by a newline. Keys are deterministic per delivery:

YOUR_PREFIX/dt=YYYY-MM-DD/hour=HH/DELIVERY_ID.ndjson

The date and hour use UTC. Deterministic keys make a retry overwrite the same logical object instead of creating another key.

Troubleshooting

• 403 response: confirm the access key is active and its policy permits s3:PutObject on the exact bucket and prefix.
• Wrong region or bucket: copy both values from the S3 console and run another test.
• Bucket policy requires encryption headers: align the bucket policy with the current connector request or use bucket default encryption.
• Rotate credentials: replace the access key in Nimriz, test it, then deactivate the previous key in AWS.