AWS S3

List S3 buckets and the objects in them.

Connect it in the console under Integrations > Connectors. See Connectors for how connectors work and who can use them.

Create a read-only credential

Create an IAM user with an access key and a policy that only lists:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["s3:ListAllMyBuckets"], "Resource": "*" },
    { "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::my-bucket"] }
  ]
}

Settings

Setting		Notes
Access key ID	Required	For example AKIA....
Secret access key	Required	Stored encrypted and never shown again.
Region	Required	For example us-east-1.
Default bucket	Optional

A bucket in another region than the one you set is reported as such; change Region to match.

Tables

Table	Filters	Returns
buckets	None	Buckets the key can list.
objects	bucket, prefix, start_after	Objects in a bucket (the default bucket, or the bucket filter).

Query from the API

curl -s -X POST "https://api.vaif.studio/database/connector/$VAIF_PROJECT_ID/query" \
  -H "Authorization: Bearer $VAIF_TOKEN" -H "Content-Type: application/json" \
  -d '{"wrapperId":"s3_fdw","table":"objects","filters":{"bucket":"my-bucket","prefix":"invoices/2026/"},"limit":50}'

$VAIF_TOKEN is a console access token. See Connectors for the routes.

How it stays read-only

The connector lists buckets and objects and never reads or writes object contents. Give the key list permissions only.