> For the complete documentation index, see [llms.txt](https://docs.ovaledge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ovaledge.com/connectors/connector-repositories/cloud-storage/amazon-s3.md).

# Amazon S3

This article outlines the integration with the Amazon S3 connector, enabling streamlined metadata management through features such as crawling of files and folders, profiling, and data preview. It also supports metadata extraction for multiple file formats, including CSV, XLSX, XLS, PARQUET, ORC, JSON, YAML, TXT, and PIP files.

This connector uses the AWS S3 SDK to establish connectivity with Amazon S3 and supports Role-Based Authentication and IAM User Authentication for accessing buckets, folders, and files.

<figure><img src="/files/vxBFQvKmYHYQq6n13ErA" alt=""><figcaption></figcaption></figure>

## **Overview**

### **Connector Details**

| Connector Category                                                       | Cloud Storage |
| ------------------------------------------------------------------------ | ------------- |
| OvalEdge Release Current Connector Version                               | 6.3.4         |
| <p>Connectivity</p><p><em>\[How OvalEdge connects to Amazon S3]</em></p> | AWS S3 SDK    |
| <p>OvalEdge Releases Supported</p><p>(Available from)</p>                | Release4.0    |

### **Connector Features**

| Feature                                      | Availability |
| -------------------------------------------- | :----------: |
| Crawling / Cataloging                        |       ✅      |
| Delta Crawling                               |       ❌      |
| Profiling\*                                  |       ✅      |
| Sample Profiling                             |       ✅      |
| Query Sheet                                  |      NA      |
| Data Preview                                 |       ✅      |
| Auto Lineage                                 |      NA      |
| Manual Lineage                               |       ✅      |
| Secure Authentication via Credential Manager |       ✅      |
| Data Quality                                 |       ✅      |
| DAM (Data Access Management)                 |       ✅      |
| Bridge                                       |       ✅      |

{% hint style="info" %}
"NA" indicates that the respective feature is 'Not Applicable.'
{% endhint %}

{% hint style="info" %}
\*Full profiling is supported through DuckDB. To enable this capability, configure the system setting (**enable.duckdb**) to **True**. When enabled, the File Data tab displays only the first 100 rows from the source file.
{% endhint %}

### **Metadata Mapping**

The following objects are crawled from Amazon S3 and mapped to the corresponding UI assets.

<table><thead><tr><th width="170.66668701171875">Amazon S3 Object</th><th width="182.8333740234375">Amazon S3 Attribute</th><th width="182.6666259765625">OvalEdge Attribute</th><th width="180.5">OvalEdge Category</th><th width="177.1666259765625">OvalEdge Type</th></tr></thead><tbody><tr><td>Bucket</td><td>Folder</td><td>Folder</td><td>Folder</td><td>Folder</td></tr><tr><td>File</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>XLSX</td><td>Folder(subfile)</td><td>Folder(subfile)</td><td>Folder(subfile)</td><td>Folder(subfile)</td></tr><tr><td>XLS</td><td>Folder(subfile)</td><td>Folder(subfile)</td><td>Folder(subfile)</td><td>Folder(subfile)</td></tr><tr><td>CSV</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>TXT</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>PARQUET</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>ORC</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>JSON</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>YAML</td><td>File</td><td>File</td><td>File</td><td>File</td></tr><tr><td>PIP</td><td>File</td><td>File</td><td>File</td><td>File</td></tr></tbody></table>

## **Set up a Connection**&#x20;

### **Prerequisites**

The following are the prerequisites to establish a connection:

Ensure that the CSV files follow the required formatting standards for proper data processing and visibility. Refer to [CSV Format Requirements](https://docs.ovaledge.com/connectors/additional-requirements/csv-format-requirements-for-file-connectors)**.**

#### **File Naming Convention**

Ensure that all file names within the selected folders and subfolders follow the supported naming convention and do not contain the NTFS Alternate Data Stream (ADS) separator character (:).

{% hint style="warning" %}
Files with unsupported naming patterns may be skipped during Catalog and Profile operations. To ensure successful execution and complete metadata extraction, rename such files before triggering the job.
{% endhint %}

#### **Service Account User Permissions**

{% hint style="warning" %}
It is recommended to use a separate service account to establish the connection to the data source, configured with the following minimum set of permissions.
{% endhint %}

{% hint style="info" %}
👨‍💻**Who can provide these permissions?** These permissions are typically granted by the Amazon S3 administrator, as users may not have the required access to assign them independently.
{% endhint %}

<table data-search="false"><thead><tr><th width="138">Operations</th><th width="176">Objects</th><th width="179">Sys Tables</th><th width="368">Access Permissions</th></tr></thead><tbody><tr><td>Connection Validation</td><td>-</td><td>S3 Client / STS</td><td>Valid AWS credentials (IAM user keys or assumed role). <code>sts:GetCallerIdentity</code> is allowed by default. <code>sts:AssumeRole</code> is required for cross-account Role-Based authentication.</td></tr><tr><td>Crawling</td><td>Buckets / Bucket Region / Bucket Tags / Bucket Encryption</td><td>S3 Buckets / Bucket Tags / Bucket Encryption Configuration</td><td><code>s3:ListAllMyBuckets</code> / <code>s3:GetBucketLocation</code> / <code>s3:GetBucketTagging</code> / <code>s3:GetEncryptionConfiguration</code></td></tr><tr><td>Crawling</td><td>Files / Folders</td><td>S3 Objects / Prefixes</td><td><code>s3:ListBucket</code></td></tr><tr><td>Crawling / Connection Validation</td><td>Object Metadata / Bucket / Folder Path</td><td>S3 Objects / Bucket</td><td><code>s3:GetObject</code> / <code>s3:ListBucket</code></td></tr><tr><td>Profiling / Data Preview / Data Quality / Bridge</td><td>Files</td><td>S3 Objects</td><td><code>s3:GetObject</code>. For SSE-KMS encrypted objects with a Customer Managed Key, <code>kms:Decrypt</code> and <code>kms:DescribeKey</code> are additionally required.</td></tr><tr><td>Copy File to S3 (AskEdgi)</td><td>Files</td><td>S3 Objects</td><td><code>s3:PutObject</code>. Required only when the copy-to-location feature is used.</td></tr><tr><td>Cross-Account Authentication</td><td>AWS Account / Role</td><td>STS Cross-Account Role</td><td><code>sts:AssumeRole</code> on the target role. The target role trust policy must allow the source account/principal to assume the role.</td></tr></tbody></table>

#### Cross-Account Role Prerequisites

For cross-account access, ensure the following configurations are completed:

* The target AWS IAM role must include a trust policy that allows the source account or IAM principal to assume the role.
* The IAM principal or role used by the application must have the `sts:AssumeRole` permission for the target role.

#### SSE-KMS Bucket Permissions

For Amazon S3 buckets encrypted using SSE-KMS, additional AWS KMS permissions are required.

Along with `s3:GetObject`, the IAM principal or assumed role must also have the following permissions on the associated Customer Managed Key (CMK):

* `kms:Decrypt`
* `kms:DescribeKey` (if applicable)

### **Connection Configuration Steps**

{% hint style="warning" %}
Users are required to have the Connector Creator role in order to configure a new connection.
{% endhint %}

1. Log into **OvalEdge**, go to **Administration > Connectors**, click **+ (New Connector)**, search for **Amazon S3**, and complete the required parameters.

{% hint style="info" %}
Fields marked with an asterisk (**\***) are mandatory for establishing a connection.
{% endhint %}

<table><thead><tr><th width="219">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Connector Type</td><td>By default, "Amazon S3" is displayed as the selected connector type.</td></tr><tr><td>Authentication<strong>*</strong></td><td><p>The following two types of authentication are supported for Amazon S3:</p><ul><li>Role Based Authentication (Default)</li><li>IAM User Authentication</li></ul></td></tr></tbody></table>

{% tabs %}
{% tab title="Role Based Authentication" %}

<table><thead><tr><th width="209.8333740234375">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Credential Manager*</td><td><p>Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on the selection.</p><p>Supported Credential Managers:</p><ul><li>OE Credential Manager</li><li>AWS Secrets Manager</li><li>HashiCorp</li><li>Azure Key Vault</li></ul></td></tr><tr><td>License Add Ons</td><td><p> </p><ul><li>Select the checkbox for <strong>Data Quality Add-On</strong> to identify data quality issues using data quality rules and anomaly detection.</li><li>Select the checkbox for <strong>Data Access Add-On</strong> to enable the data access functionality.</li></ul></td></tr><tr><td>Connector Name*</td><td><p>Enter a unique name for the Amazon S3 connection              </p><p>(Example: "AmazonS3db").</p></td></tr><tr><td>Connector Description</td><td>Enter a brief summary or details about the connector.</td></tr><tr><td>Connector Environment</td><td>Select the environment (Example: PROD, STG) configured for the connector.</td></tr><tr><td>Cross-Account Role ARN</td><td>Enter the ARN (Amazon Resource Name) of the role used for cross-account access.</td></tr><tr><td>Filter by tags</td><td>Enter one or more tags to narrow down and display only the items associated with those tags.<br>(Example: Key1=value1, key2=value2)</td></tr><tr><td>Region</td><td>Enter the region where the Amazon S3 files or resources are located.</td></tr></tbody></table>
{% endtab %}

{% tab title="IAM User Authentication" %}

<table><thead><tr><th width="209.8333740234375">Field Name</th><th>Description</th></tr></thead><tbody><tr><td>Credential Manager*</td><td><p>Select the desired credentials manager from the drop-down list. Relevant parameters will be displayed based on the selection.</p><p>Supported Credential Managers:</p><ul><li>OE Credential Manager</li><li>AWS Secrets Manager</li><li>HashiCorp</li><li>Azure Key Vault</li></ul></td></tr><tr><td>License Add Ons</td><td><p> </p><ul><li>Select the checkbox for Data Quality Add-On to identify data quality issues using data quality rules and anomaly detection.</li><li>Select the checkbox for Data Access Add-On to enable the data access functionality.</li></ul></td></tr><tr><td>Auto Lineage</td><td>Not Supported</td></tr><tr><td>Data Quality</td><td>Supported</td></tr><tr><td>Data Access</td><td>Supported</td></tr><tr><td>Connector Name*</td><td><p>Enter a unique name for the Amazon S3 connection              </p><p>(Example: "AmazonS3db").</p></td></tr><tr><td>Connector Description</td><td>Enter a brief summary or details about the connector.</td></tr><tr><td>Connector Environment</td><td>Select the environment (Example: PROD, STG) configured for the connector.</td></tr><tr><td>Access key*</td><td>Enter the AWS Access Key ID used to authenticate the IAM user.</td></tr><tr><td>Secret key*</td><td>Enter the AWS Secret Access Key associated with the Access Key ID.</td></tr><tr><td>Filter by tags</td><td>Enter one or more tags to narrow down and display only the items associated with those tags.</td></tr><tr><td>Region</td><td>Enter the region where the Amazon S3 files or resources are located.</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

**Default Governance Roles**

<table data-header-hidden><thead><tr><th width="219.8333740234375"></th><th></th></tr></thead><tbody><tr><td>Default Governance Roles<strong>*</strong></td><td>Select the appropriate users or teams for each governance role from the drop-down list. All users configured in the security settings are available for selection.</td></tr></tbody></table>

**Admin Roles**

<table data-header-hidden><thead><tr><th width="219.8333740234375"></th><th></th></tr></thead><tbody><tr><td>Admin Roles<strong>*</strong></td><td>Select one or more users from the dropdown list for Integration Admin and Security &#x26; Governance Admin. All users configured in the security settings are available for selection.</td></tr></tbody></table>

**No of Archive Objects**

<table data-header-hidden><thead><tr><th width="219.83331298828125"></th><th></th></tr></thead><tbody><tr><td>No Of Archive Objects<strong>*</strong></td><td><p>This shows the number of recent metadata changes to a dataset at the source. By default, it is off. To enable it, toggle the Archive button and specify the number of objects to archive.</p><p><strong>Example</strong>: Setting it to 4 retrieves the last four changes, displayed in the 'Version' column of the 'Metadata Changes' module.</p></td></tr></tbody></table>

**Bridge**

<table data-header-hidden><thead><tr><th width="219.8333740234375"></th><th></th></tr></thead><tbody><tr><td>Select Bridge<strong>*</strong></td><td><p>If applicable, select the bridge from the drop-down list.</p><p>The drop-down list displays all active bridges that have been configured. These bridges facilitate communication between data sources and the system without requiring changes to firewall rules.</p></td></tr></tbody></table>

2. After entering all connection details, the following actions can be performed:
   1. Click **Validate** to verify the connection.
   2. Click **Save** to store the connection for future use.
   3. Click **Save & Configure** to apply additional settings before saving.
3. The saved connection will appear on the Connectors home page.

## **Manage Connector Operations**

### **Crawl/Profile**

{% hint style="info" %}
To perform crawl and profile operations, users must be assigned the Integration Admin role.
{% endhint %}

1. Navigate to the **Connectors** page and click **Crawl/Profile.**
2. This action initiates the metadata collection process from the data source and loads the retrieved metadata into the **File Manager > File Explorer.**
3. In the File Manager, click the connector name, select the specific **folder(s) or file(s)**, then click **Catalog / Catalog and Profile** from the **Nine Dots** menu. For more details, click [here](https://docs.ovaledge.com/file-manager/file-explorer).

{% hint style="info" %}
Profiling is supported only at the individual file level through the File Nine Dots menu in File Manager. File columns are fetched into the system only after the profiling process has been successfully completed.
{% endhint %}

4. The selected files or folders will be added to the **Data Catalog > Files/File Columns** tab.

#### **Other Operations**

The **Connectors** page provides a centralized view of all configured connectors, along with their health status.

**Managing connectors includes:**

* **Connectors Health**: Displays the current status of each connector using a **green** icon for active connections and a **red** icon for inactive connections, helping to monitor the connectivity with data sources.
* **Viewing**: Click the **Eye icon** next to the connector name to view connector details, including databases, tables, columns, and codes.

**Nine Dots Menu Options**:

To view, edit, validate, configure, or delete connectors, click on the **Nine Dots** menu.

* **Edit Connector**: Update and revalidate the data source.
* **Validate Connector**: Check the connection's integrity.
* **Settings**: Modify connector settings.
  * **Crawler**: Configure data extraction.
  * **Access Instructions**: Add notes on how data can be accessed.
  * **Business Glossary Settings**: Manage term associations at the connector level.
  * **Anomaly Detection Settings**: Configure anomaly detection preferences at the connector level.
  * **Others**: Configure notification recipients for metadata changes.
* **Delete Connector:** Remove a connector with confirmation.

For more details, click [here](https://docs.ovaledge.com/connectors/introduction-to-connectors/setup-and-connectivity/connector-settings).

## **Connectivity Troubleshooting**

If incorrect parameters are entered, error messages may appear. Ensure all inputs are accurate to resolve these issues. If issues persist, contact the assigned support team.

{% tabs %}
{% tab title="Connectivity" %}

<table data-search="true"><thead><tr><th width="83">S. No</th><th width="257">Error Message</th><th width="559">Error Description &#x26; Resolution</th></tr></thead><tbody><tr><td>1</td><td>Connection validation fails or cannot proceed when Role-Based Authentication is selected</td><td><p>Role-Based Authentication is applicable only when the hosting application resides on AWS as a SaaS deployment; it does not apply to non-AWS-hosted deployments. At present, validation using this authentication mode is not functioning as expected.</p><p><strong>Resolution</strong></p><ul><li>Confirm the hosting environment of the application; Role-Based Authentication should only be attempted for AWS-hosted deployments.</li><li>Where validation issues persist, use IAM User Authentication (access key and secret key) as the supported alternative.</li><li>Log a request for further investigation if Role-Based Authentication continues to be required for the environment in question.</li></ul></td></tr><tr><td>2</td><td>Buckets residing in a different AWS account than the hosting application are not accessible during crawl, despite correct IAM permissions</td><td><p>When the application is hosted in one AWS account and the target buckets reside in a separate AWS account, standard IAM permissions on the hosting account are not sufficient. A cross-account trust relationship must be established between the two accounts.</p><p><strong>Resolution</strong></p><ul><li>Confirm with the AWS administrator managing both accounts that a trust policy has been created to allow the hosting account to assume a role in the target account.</li><li>Provide the cross-account Role ARN in the connection details field so the assumed role can be used during validation and crawling.</li><li>If a bridge is used for connectivity, ensure the same cross-account role and permission set are also configured on the bridge side, as bridge-based access does not automatically inherit hosting-account permissions.</li></ul></td></tr><tr><td>3</td><td>Connection validation fails specifically when connecting through a bridge, while direct (non-bridge) validation succeeds</td><td><p>When IAM User Authentication is used through a bridge, the same IAM credentials and associated permissions must also be present and valid on the virtual machine where the bridge is installed, not only in the hosting environment.</p><p><strong>Resolution</strong></p><ul><li>Confirm that the same access key and secret key used in the connection details are also configured on the bridge VM.</li><li>Verify that the required AWS permissions (bucket-level and object-level) are replicated for the bridge environment.</li><li>Re-attempt validation after confirming credential and permission parity between the hosting environment and the bridge VM.</li></ul></td></tr><tr><td>4</td><td>Please provide valid credentials: The AWS Access Key Id you provided does not exist in our records. (Service: Amazon S3; Status Code: 403; Error Code: InvalidAccessKeyId; Request ID: 73xxxxG; S3 Extended Request ID: jmxxx1JOJYLpbHOl1t2mqyKlmArTw=; Proxy: null)</td><td><p>Invalid Access Key<br><br><strong>Resolution:</strong></p><ul><li>Verify that the configured AWS Access Key ID is correct and active.</li><li>Ensure that the access key belongs to the intended AWS account.</li><li>Update the connection with a valid access key and revalidate the connection.</li></ul></td></tr><tr><td>5</td><td>The request signature we calculated does not match the signature you provided. Check your key and signing method. If you start to see this issue after you upgrade the SDK to 1.xx.xx0 or later, it could be because the bucket provided contains '/'. (Service: Amazon S3; Status Code: 403; Error Code: SignatureDoesNotMatch; Request ID: NxxxxH; S3 Extended Request ID: 3xxxxCbU=; Proxy: null)</td><td><p>Invalid Secret Key<br><br><strong>Resolution:</strong></p><ul><li>Verify that the configured AWS Secret Access Key is correct.</li><li>Ensure that only the bucket name is provided without any folder path or prefix.</li><li>Revalidate the connection after updating the secret key or bucket configuration.</li></ul><p><strong>Note</strong>: With AWS SDK version <code>1.xx.460</code> and later, entering a bucket value that includes a forward slash (<code>/</code>) or path prefix may result in an <code>SignatureDoesNotMatch</code> error. Ensure that only the bucket name is provided without any folder path or prefix.</p></td></tr></tbody></table>
{% endtab %}

{% tab title="Crawling" %}

<table data-search="true"><thead><tr><th width="83">S. No</th><th width="200">Error Message</th><th width="570">Error Description &#x26; Resolution</th></tr></thead><tbody><tr><td>1</td><td>Bucket or file not appearing after crawl completes, with no error raised in the job logs</td><td><p>Bucket or file names containing a semicolon or extra/trailing spaces are not supported during the crawling process. Such objects are silently excluded rather than raising a hard failure.</p><p><strong>Resolution</strong>:</p><ul><li>Confirm the naming convention of the bucket or file in the AWS environment for semicolons or additional spaces.</li><li>Rename the affected bucket or file in AWS to remove unsupported characters, then re-run the crawl.</li><li>Cross-check the file manager after the crawl to confirm the object now appears once renamed.</li></ul></td></tr><tr><td>2</td><td>Specific buckets missing from the crawl results while other buckets in the same account are crawled successfully</td><td><p>The crawling process does not fail entirely when a permission is missing on a given bucket; instead, the specific bucket lacking one or more required permissions (ListBucket, GetBucketLocation, GetBucketTagging, GetObject) is skipped, while buckets with complete permissions continue to be crawled normally.</p><p><strong>Resolution</strong>:</p><ul><li>Review the IAM policy attached to the service account/access key and compare it against the required permission list documented for the connector.</li><li>Ensure each required permission is granted on the specific bucket resource (ARN) that needs to be crawled, not only at the account level.</li><li>Re-run the crawl job after updating the policy and confirm the previously missing bucket now appears in the file manager.</li></ul></td></tr><tr><td>3</td><td>Certain files not appearing in the catalog after a crawl, even though they exist in the source bucket</td><td><p>Cataloging is governed entirely by the list of supported file extensions configured under connection settings. Any file extension not present in this configured list is excluded from cataloging by default.</p><p><strong>Resolution</strong>:</p><ul><li>Navigate to the connection settings and review the list of configured file type extensions.</li><li>Add the required file extension to the supported file types list if it is missing.</li><li>Re-run the crawl. Note that adding an extension enables cataloging only and does not automatically enable profiling for that file type.</li></ul></td></tr></tbody></table>
{% endtab %}

{% tab title="Profiling" %}

<table data-search="true"><thead><tr><th width="85">S. No</th><th width="194">Error Message</th><th>Error Description &#x26; Resolution</th></tr></thead><tbody><tr><td>1</td><td>Files are cataloged successfully but profiling results (row/column statistics) are not generated</td><td><p>Cataloging and profiling are handled as two separate capabilities. Profiling is supported only for a limited set of file types (approximately five to six formats), regardless of how many extensions have been added for cataloging purposes.</p><p><strong>Resolution:</strong></p><ul><li>Confirm whether the file type in question falls within the officially supported profiling formats.</li><li>If the file type is outside the supported profiling list, cataloging will continue to function, but profiling results should not be expected.</li><li>Where profiling is required, convert or standardize the source file to one of the supported formats.</li></ul></td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## FAQs

{% tabs %}
{% tab title="Connectivity" %}

<table data-search="true"><thead><tr><th width="88">S. No.</th><th width="191">Question</th><th width="602">Answer</th></tr></thead><tbody><tr><td>1</td><td>What is the difference between Role-Based Authentication and IAM User Authentication?</td><td><p>Two authentication types are available:</p><ul><li><strong>Role-Based Authentication</strong> uses an <strong>AWS role</strong> to obtain temporary credentials for accessing AWS resources. This option applies when the application is hosted on <strong>AWS</strong> and does not apply when the application is hosted outside AWS, such as on Azure.</li><li><strong>IAM User Authentication</strong> uses an <strong>access key ID</strong> and <strong>secret access key</strong> associated with an AWS user. This option works regardless of where the application is hosted.</li></ul><p>The access key ID and secret access key do not display the IAM user's name. AWS uses these credentials to identify the IAM principal and apply the permissions defined by the associated IAM policies.</p></td></tr><tr><td>2</td><td>What happens if the Region field is left empty?</td><td><p>The Region field is <strong>not mandatory</strong>. If left empty, <strong>US East (the default AWS region, us-east-1) is automatically selected</strong> and used to establish the connection client.</p><ul><li>Specifying a region does not limit crawling to buckets in that region. Buckets and folders from other regions are also crawled.</li><li>Leaving the region field empty does not affect the connection or crawling process. All accessible buckets and folders are crawled regardless of their region.</li><li>The region value is primarily used by the backend to initialize the AWS client connection.</li></ul></td></tr><tr><td>3</td><td>What is a Cross-Account Role (ARN), and when is it required?</td><td><p>A Cross-Account Role becomes necessary when the buckets that need to be crawled exist in a <strong>different AWS account</strong> than the one hosting the application. In this scenario:</p><ul><li>The AWS administrator must set up a <strong>trust policy</strong> between the two accounts, allowing the hosting account to assume a role in the account where the buckets reside.</li><li>The resulting <strong>Role ARN</strong> is then entered in the connection details.</li><li>This field is <strong>not mandatory</strong> - if left blank, the default permissions already assigned to the hosting account are used instead.</li><li>This requirement applies equally to both IAM User Authentication and Role-Based Authentication.</li><li>If a bridge is being used, the same cross-account permission setup must also be replicated on the bridge side.</li></ul></td></tr></tbody></table>
{% endtab %}

{% tab title="Crawling" %}

<table data-search="true"><thead><tr><th width="88">S. No.</th><th width="193">Question</th><th width="609">Answer</th></tr></thead><tbody><tr><td>1</td><td>What is Amazon S3, and how are buckets, folders, and files represented?</td><td><p>Amazon S3 (Simple Storage Service) is a cloud storage service used to store objects in AWS. Structurally:</p><ul><li>A <strong>bucket</strong> is the top-level container and is treated the same as a <strong>folder</strong>.</li><li><strong>Folders inside a bucket</strong> are also treated as folders - there is no separate naming convention for buckets versus folders.</li><li>Individual objects inside folders are treated as standard <strong>files</strong>.</li></ul><p>This consistent folder/file structure is intentional - using a different naming convention for buckets would create confusion, so the same two object types (folder and file) apply across all file-based connectors.</p></td></tr><tr><td>2</td><td>What is the Filter Tag field, and how does it work?</td><td><p>The Filter Tag field allows crawling to be limited to a specific subset of buckets rather than every bucket in the AWS account. Key points:</p><ul><li>Tags are <strong>configured directly in the AWS environment</strong> at the bucket level, in a key=value format (for example, <code>team=finance</code> or <code>region=Virginia</code>).</li><li>The exact same key=value tag must be entered in the connection details to filter for matching buckets.</li><li>If <strong>no tag is entered</strong>, every bucket in the account is included in the crawl, without any filtering applied.</li><li>If a tag is entered, only buckets carrying that exact tag in AWS will be crawled; buckets without a matching tag are skipped automatically (this is expected behavior, not an error).</li><li>Tags are commonly used in AWS to classify resources (for example, by department, environment, or cost center), and this same tagging structure is being leveraged here purely to control which buckets get crawled.</li></ul></td></tr><tr><td>3</td><td>How are Excel (XLSX) files handled during cataloging?</td><td>Excel files are cataloged using a <strong>subfile</strong> structure. Each sheet within an XLSX file is treated as an <strong>individual, separate file</strong>. For example, a workbook containing ten sheets will be cataloged as ten separate file entries rather than a single combined file.</td></tr><tr><td>4</td><td>Are Delta Crawl, Query Sheet, and Automatic Lineage available for the S3 connector?</td><td><p>No, none of these three capabilities are available for this connector:</p><ul><li><strong>Delta Crawl</strong> is not supported.</li><li><strong>Query Sheet</strong> is not available since S3 is not a relational database (RDBMS).</li><li><strong>Automatic Lineage</strong> is not generated; however, <strong>manual lineage</strong> can still be created by directly linking files to relevant lineage objects.</li></ul></td></tr><tr><td>5</td><td>What naming restrictions apply to buckets and files?</td><td>Bucket and file names should not contain a <strong>semicolon</strong> or <strong>extra/trailing spaces</strong>. Objects with these characters in their names will not be crawled successfully and will be excluded without a hard failure being raised.</td></tr></tbody></table>
{% endtab %}

{% tab title="Profiling" %}

<table data-search="true"><thead><tr><th width="88">S. No.</th><th width="192">Question</th><th width="610">Answer</th></tr></thead><tbody><tr><td>1</td><td>What is the difference between a file being "cataloged" and a file being "profiled"?</td><td><p>These are two separate, independent processes:</p><ul><li><strong>Cataloging</strong> simply lists and records the file's existence (name, location, type) and depends entirely on whether that file extension has been added to the supported file types list in connection settings.</li><li><strong>Profiling</strong> analyzes the actual data inside the file (row counts, column statistics, data quality) and is only available for a limited set of supported file formats (approximately five to six types), regardless of how many extensions are enabled for cataloging.</li></ul><p>Adding a new file extension to the settings enables cataloging of that file type but does <strong>not</strong> automatically enable profiling for it.</p></td></tr></tbody></table>
{% endtab %}
{% endtabs %}

## Limitations

<table><thead><tr><th width="92.666748046875">S.No.</th><th>Description</th></tr></thead><tbody><tr><td>1</td><td>Users cannot view files in a folder in the File Manager after a crawl if the S3 connector source contains folder names that start or end with spaces.</td></tr><tr><td>2</td><td>For File-based connectors, the folder count in the File Manager and Data Catalog Files module may not match if folders or files are added or deleted in the source system after crawling. Run the connection crawl again to refresh and display the latest changes.</td></tr></tbody></table>

Copyright © 2026, OvalEdge LLC, Peachtree Corners GA USA


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ovaledge.com/connectors/connector-repositories/cloud-storage/amazon-s3.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.