Export files to Amazon S3
🤖/s3/store exports encoding results to Amazon S3.

If you are new to Amazon S3, see our tutorial on using your own S3 bucket.
The URL to the result file in your S3 bucket will be returned in the Assembly Status JSON. A returned URL does not make a private object public or grant read access. If your S3 bucket has versioning enabled, the version ID of the file will be returned within meta.version_id.
Configure private buckets explicitly. The Robot’s default acl is still "public-read". For a private bucket, set acl: "bucket-default" and do not supply ACL or grant headers. This omits the generated ACL header and works with Bucket owner enforced Object Ownership, where ACLs are disabled. Keep S3 Block Public Access enabled. Setting acl: "private" still sends an ACL and is not equivalent to omitting it.
Use DNS-compliant bucket names. Follow AWS’s bucket naming rules. The url_prefix parameter changes returned URLs; it does not change the bucket or its access permissions.
Limit access
Use a dedicated AWS identity with access limited to the destination bucket and object prefix. Do not use AWS root access keys. Store its access key ID, secret access key, bucket name and region as key, secret, bucket and bucket_region in Template Credentials, then reference their name with credentials. Trusted backend integrations can instead supply those parameters directly; do not expose AWS secrets in browser instructions.
The following is an identity-based IAM policy, attached to that dedicated identity, not a bucket policy. It intentionally has no Principal. Replace {BUCKET_NAME} and use a Robot path beginning with uploads/, or adapt both the policy prefix and the path together.
This example covers uploads and failed multipart-upload cleanup with an explicit bucket_region, acl: "bucket-default", no ACL/grant headers, no tags and S3-managed encryption (SSE-S3). Existing bucket policies, organization controls or endpoint policies can still deny access.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "UploadAndAbortWithinPrefix",
"Effect": "Allow",
"Action": ["s3:PutObject", "s3:AbortMultipartUpload"],
"Resource": "arn:aws:s3:::{BUCKET_NAME}/uploads/*"
}
]
}
The uploader uses either PutObject or CreateMultipartUpload, UploadPart and CompleteMultipartUpload; failed multipart uploads can trigger AbortMultipartUpload. AWS maps the successful upload operations to s3:PutObject. Write access can overwrite an existing object key; it is not add-only. Choose unique object paths and consider versioning for recovery.
Add permissions only for features you use, following AWS’s operation permission reference:
- Without an explicit
bucket_region, region discovery can requires3:GetBucketLocationand fallbacks3:ListBucketon the bucket ARN,arn:aws:s3:::{BUCKET_NAME}, without an object suffix. Supplying the correct region avoids these discovery requests. - ACL or grant headers require
s3:PutObjectAcl; tags requires3:PutObjectTaggingon the allowed object prefix.bucket-defaultdoes not remove ACL/grant headers you supply inheaders. - Downloading private results requires separate read authorization. Even a URL generated with
sign_urls_forneeds the signing identity to have the appropriate read permissions.
S3 applies its bucket encryption configuration when no encryption override is sent. You can request SSE-KMS through headers, using x-amz-server-side-encryption: aws:kms and x-amz-server-side-encryption-aws-kms-key-id. When either bucket default encryption or request headers select SSE-KMS, the uploading identity needs kms:GenerateDataKey on the relevant key, plus kms:Decrypt for multipart uploads. For a customer-managed key, grant these permissions with a compatible KMS key policy; the base S3 policy above does not include them. Do not add blanket kms:* or sts:* grants.
Short-lived AWS credentials are a matching set of key, secret and session_token. Have a trusted backend obtain and refresh all three, then supply them together when it creates the Assembly. It can pass them directly in Robot instructions or save and update them together through the Template Credentials API. Keep all three out of browser instructions; replacing only the session token does not refresh expired access keys. This Robot passes the supplied credentials to S3; it does not assume a role or refresh expired credentials. Keep temporary credentials valid for the upload.
Usage example
Export uploaded files to my_target_folder in an S3 bucket:
{
"steps": {
"exported": {
"credentials": "YOUR_AWS_CREDENTIALS",
"path": "my_target_folder/${unique_prefix}/${file.url_name}",
"robot": "/s3/store",
"use": ":original"
}
}
}Parameters
interpolateboolean | Record<string, boolean>Controls whether Assembly Variables are interpolated for individual instruction fields.
By default, most Robot instruction fields interpolate Assembly Variables. Set this to
falseto treat every instruction field as literal text, or set an individual field path tofalseto treat only that field as literal text. For Robot-specific fields that are literal by default, set this totrueor set that field path totrueto opt back into interpolation.Use field names such as
path, or dotted paths such asffmpeg.vffor nested objects.output_metaRecord<string, boolean> | boolean | Array<string>Allows you to specify a set of metadata that is more expensive on CPU power to calculate, and thus is disabled by default to keep your Assemblies processing fast.
For images, you can add
"has_transparency": truein this object to extract if the image contains transparent parts and"dominant_colors": trueto extract an array of hexadecimal color codes from the image.For images, you can also add
"blurhash": trueto extract a BlurHash string — a compact representation of a placeholder for the image, useful for showing a blurred preview while the full image loads.For images,
"thumbhash": trueinstead extracts a base64-encoded ThumbHash intometa.thumbhash, together withmeta.has_alpha(whether an alpha channel exists, even when fully opaque). It describes EXIF-oriented pixels and uses the first frame of animated images. Extraction is best-effort: images above 40 megapixels, unsupported formats, or a failed/bounded decode produce no placeholder. Successful extraction adds a metadata charge equivalent to 20% of that file's bytes. No ThumbHash surcharge applies when disabled or when no hash is produced.Set this option on the Step producing the image, such as
/upload/handlefor uploaded originals or/image/resizefor processed outputs. Setting it only on/transloadit/storedoes not request extraction: storage preserves the producer's metadata. Transloadit Storage persists a generated hash with its immutable version and returns it in stored results and native asset reads. Direct S3 uploads do not generate placeholders. A placeholder contains image information, so protect it with the same access controls as the full image.For videos, you can add the
"colorspace": trueparameter to extract the colorspace of the output video.For videos, you can also add
"interlaced": trueto detect whether the video is interlaced. This combines the cheap ffprobefield_orderflag with a boundedidetsampling pass over the first frames of the source, exposinginterlaced,field_order, and a diagnosticinterlace_detectionobject underfile.meta. This is computationally expensive and billed accordingly.For audio, you can add
"mean_volume": trueto get a single value representing the mean average volume of the audio file.You can also set this to
falseto skip metadata extraction and speed up transcoding.user_metaRecord<string, any>(default:{})Adds custom JSON metadata to each emitted file without changing its contents. Nested objects and arrays are supported.
Inheritance depends on the Robot. Values merge with existing
user_metaon the output file; the current Step replaces matching top-level keys. Assign required keys explicitly when a Robot creates fresh outputs.In processing Steps,
${file.*}refers to the first input and${result.*}to the emitted file. Values are evaluated per output after the Robot runs, before subsequent metadata extraction and temporary storage. On:original, values are evaluated per upload before metadata extraction.Downstream Steps read
${file.user_meta.key}. See Custom metadata for a complete example and inheritance rules.resultboolean(default:false)Whether the results of this Step should be present in the Assembly Status JSON
queuebatchSetting the queue to 'batch', manually downgrades the priority of jobs for this step to avoid consuming Priority job slots for jobs that don't need zero queue waiting times
force_acceptboolean(default:false)Force a Robot to accept a file type it would have ignored.
By default, Robots ignore files they are not familiar with. 🤖/video/encode, for example, will happily ignore input images.
With the
force_acceptparameter set totrue, you can force Robots to accept all files thrown at them. This will typically lead to errors and should only be used for debugging or combatting edge cases.ignore_errorsboolean | Array<meta | execute>(default:[])Ignore errors during specific phases of processing.
Setting this to
["meta"]will cause the Robot to ignore errors during metadata extraction.Setting this to
["execute"]will cause the Robot to ignore errors during the main execution phase.Setting this to
trueis equivalent to["meta", "execute"]and will ignore errors in both phases.usestring | Array<string> | Array<object> | objectSpecifies which Step(s) to use as input.
- You can pick any names for Steps except
":original"(reserved for user uploads handled by Transloadit) - You can provide several Steps as input with arrays:
{ "use": [ ":original", "encoded", "resized" ] } - You can also tag input Steps with
asto pass semantic intent to robots:{ "use": [ { "name": ":original", "as": "image" }, { "name": ":original", "as": "mask" } ] }
TipThat's likely all you need to know about
use, but you can view Advanced use cases.- You can pick any names for Steps except
credentialsstringPlease create your associated Template Credentials in your Transloadit account and use the name of your Template Credentials as this parameter's value. They will contain the values for your S3
bucket,key,secretandbucket_region.While we recommend to use Template Credentials at all times, some use cases demand dynamic credentials for which using Template Credentials is too unwieldy because of their static nature. If you have this requirement, feel free to use the following parameters instead:
"bucket","bucket_region"(for example:"us-east-1"or"eu-west-2"),"key","secret".pathstring(default:"${unique_prefix}/${file.url_name}")The path at which the file is to be stored. This may include any available Assembly variables. The path must not be a directory.
url_prefixstring(default:"http://{bucket}.s3.amazonaws.com/")The URL prefix used for the returned URL, such as
"http://my.cdn.com/some/path/".aclbucket-default | private | public | public-read(default:"public-read")The ACL used for this file. The default remains
"public-read", which can conflict with S3 Block Public Access and disabled ACLs. For modern private buckets, explicitly set"bucket-default"to omit the generated ACL header, and do not supply ACL/grant headers inheaders."private"still sends an ACL.check_integrityboolean(default:false)Calculate and submit the file's checksum in order for S3 to verify its integrity after uploading, which can help with occasional file corruption issues.
Enabling this option adds to the overall execution time, as integrity checking can be CPU intensive, especially for larger files.
headersRecord<string, string>(default:{"Content-Type":"${file.mime}"})An object containing a list of headers to be set for this file on S3, such as
{ FileURL: "${file.url_name}" }. This can also include any available Assembly Variables. You can find a list of available headers here.Object Metadata can be specified using
x-amz-meta-*headers. Note that these headers do not support non-ASCII metadata values.tagsRecord<string, string>(default:{})Object tagging allows you to categorize storage. You can associate up to 10 tags with an object. Tags that are associated with an object must have unique tag keys.
hoststring(default:"s3.amazonaws.com")The host of the storage service used. This only needs to be set when the storage service used is not Amazon S3, but has a compatible API (such as hosteurope.de). The default protocol used is HTTP, for anything else the protocol needs to be explicitly specified. For example, prefix the host with
https://ors3://to use either respective protocol.no_vhostboolean(default:false)Set to
trueif you use a custom host and run into access denied errors.sign_urls_forstring | numberThis parameter provides signed URLs in the result JSON (in the
signed_urlandsigned_ssl_urlproperties). The number that you set this parameter to is the URL expiry time in seconds. If this parameter is not used, no URL signing is done.session_tokenstringThe session token belonging to the temporary AWS access key ID and secret access key supplied for this upload. The Robot does not assume a role or refresh these credentials; they must remain valid for the upload.
Demos
Related blog posts
- API update: renaming Robots for better clarity
- Addressing S3 put request inconsistencies at Transloadit
- Introducing /s3/store Robot's 'url_prefix' parameter
- Launching SFTP Robot & unveiling new homepage
- All Robots now support expanded Assembly Variables
- Switching to official S3 CLI for enhanced file exporting
- Addressing the S3 incident with fixes and discounts
- New pricing model for future Transloadit customers
- No-code real-time video uploading with Bubble & Transloadit
- Export files to DigitalOcean Spaces with ease
- Creating audio waveform videos with FFmpeg & Node.js
- New feature: auto-transcribe videos with subtitles
- Transloadit’s 2021 milestones and progress
- Expanding our API for better Terraform provisioning
- What is content localization?
- How to set up an S3 bucket to use with Transloadit
- Automatically correct page orientation in documents
- Automatic background removal from images
- Generate stunning images from text using AI
- Upscale and enhance low-res images in one Assembly
- Extract text and images from PDFs with /document/extract
- Switching from Cloudinary, Filestack, Mux, or Uploadcare