How to Connect n8n to AWS S3: Automate File Storage & Backups (2025)

If your automations generate files — invoices, reports, PDFs, images, database dumps — you need somewhere durable and cheap to put them. Amazon S3 is the default answer for most teams, and n8n talks to it natively. In this guide you'll learn exactly how to connect n8n to AWS S3, from creating a locked-down IAM user to uploading binary files, building a scheduled backup, and generating shareable presigned URLs. Every step is concrete and copy-pasteable.

What the AWS S3 node in n8n does

The AWS S3 node is a first-party n8n integration that maps directly onto the S3 API. It lets a workflow read from and write to S3 buckets without you writing any HTTP requests or signing calls manually. The main operations you'll use are:

• Upload — put a file (binary data) into a bucket at a given key.
• Download — pull an object back out as binary data for the next node.
• Get Many / List — enumerate objects in a bucket, optionally filtered by a prefix (folder).
• Delete — remove an object.
• Copy — duplicate an object to another key or bucket (great for archiving).
• Bucket operations — create, list, or delete buckets themselves.

Because S3 is object storage, everything is a key (a full path like invoices/2025/march/inv-0042.pdf) inside a bucket. There are no real folders — the slashes are just part of the key — but n8n and the S3 console let you treat prefixes as folders, which is how you'll organize things.

Step 1: Create an IAM user with the right S3 permissions

Never use your AWS root account credentials in an automation. Create a dedicated IAM user with only the S3 access it needs.

1. In the AWS Console, open IAM → Users → Create user. Name it something like n8n-s3-bot. Do not give it console access — it only needs programmatic access.
2. On the permissions step, choose Attach policies directly. For a quick start you can attach AmazonS3FullAccess, but the safer approach is a custom inline policy scoped to a single bucket.
3. Create the user, then open it and go to Security credentials → Create access key → Application running outside AWS. Copy the Access key ID and Secret access key immediately — the secret is shown only once.

A tight least-privilege policy for one bucket looks like this:

• Actions: s3:PutObject, s3:GetObject, s3:ListBucket, s3:DeleteObject
• Resources: arn:aws:s3:::my-n8n-bucket (for ListBucket) and arn:aws:s3:::my-n8n-bucket/* (for the object actions)

Scoping to one bucket means a leaked key can't touch the rest of your AWS account. Do it — it takes two extra minutes.

Step 2: Add AWS credentials in n8n

In n8n, add an AWS credential (the S3 node uses the shared AWS credential type). You'll enter:

• Access Key ID and Secret Access Key from the previous step.
• Region — the region your bucket lives in, e.g. us-east-1 or eu-central-1. This must match the bucket's actual region or you'll get redirect errors.

You don't set the bucket in the credential — the bucket is chosen per node in each operation. Once saved, drop an AWS S3 node into a workflow, pick your credential, and it's ready. Test it fast by running a Get Many (list) operation against your bucket; if you get objects (or an empty list) back with no auth error, the connection works.

Step 3: Handling binary data — get a file into S3

This is where most people get stuck. S3 uploads expect binary data on the item, not a URL or a JSON string. In n8n, binary data lives on a named property (usually data) separate from the JSON.

The pattern is always: a node that produces binary → the S3 Upload node that consumes it. Common producers:

• HTTP Request node with response format set to File — downloads a remote file as binary.
• Google Drive / Dropbox / Read Binary File — outputs the file on a binary property.
• Gmail / Email trigger — attachments arrive as binary properties (attachment_0, attachment_1, …).

In the S3 Upload node you set the Bucket Name, the File Name / Key (e.g. reports/{{$now.format('yyyy-MM-dd')}}-summary.pdf), and point Binary Property to the property carrying the file (default data). That's the whole trick: match the binary property name between the producer and the S3 node.

Skip the build: If your files are invoices or contracts, the real goal usually isn't just storing the PDF — it's pulling the numbers out of it. The AI PDF Extractor template turns any invoice or contract into clean structured data automatically, so you can archive the file to S3 and push the extracted fields to a sheet or database in one flow. Get the AI PDF Extractor on Gumroad →

A concrete example: email attachment → S3 → log the URL in a sheet

Here's a real workflow you can build today. It captures incoming invoice attachments, files them in S3, and records the link.

1. Gmail Trigger (or IMAP Email) — fires on new emails matching a label like invoices, with "Download Attachments" enabled. Attachments come through as binary properties.
2. AWS S3 → Upload — bucket my-company-invoices, key invoices/{{$now.format('yyyy/MM')}}/{{$binary.attachment_0.fileName}}, binary property attachment_0. This organizes files into year/month prefixes automatically.
3. Set (or Code) node — build the object URL: https://my-company-invoices.s3.us-east-1.amazonaws.com/{{ $json.Key }}. Use the key the S3 node returns.
4. Google Sheets → Append Row — write the sender, date, filename, and the S3 URL to a tracking sheet.

Now every invoice that lands in your inbox is durably stored and logged, with zero manual filing. Swap the trigger for a "Generate PDF" node and you have the same flow for reports your automations create.

Building a scheduled backup workflow

S3 shines as a backup target because it's cheap and versionable. A simple nightly backup:

1. Schedule Trigger — set to run daily at, say, 02:00.
2. Producer node — export the thing you're backing up. This could be an HTTP Request pulling a database dump, a Postgres node exporting rows to a file, or a node grabbing yesterday's logs.
3. AWS S3 → Upload — key like backups/db/{{$now.format('yyyy-MM-dd')}}.sql.gz. The date in the key means each run creates a new object instead of overwriting.
4. Optional: enable S3 Lifecycle rules in AWS to auto-transition old backups to cheaper storage classes (S3 Glacier) or delete them after N days — so your backup folder doesn't grow forever.

For archiving instead of fresh exports, the S3 Copy operation lets you move an object from an "active" prefix to an "archive" prefix without downloading it — the copy happens entirely inside AWS, so it's fast and doesn't move bytes through n8n.

Presigned URLs, prefixes, and costs

Presigned URLs: S3 objects are private by default (and should stay that way). When you need to share a file — say, emailing a customer their invoice — generate a presigned URL that grants temporary, time-limited access without making the bucket public. In n8n you can produce one with an HTTP Request signed by your AWS credential, or via a small Code node using the AWS SDK. Set a short expiry (e.g. 15 minutes to a few hours) so links don't leak permanent access.

Folders and prefixes: use prefixes deliberately — invoices/2025/03/, backups/db/, exports/customer-123/. Good prefixing makes List operations fast and cheap because you can filter by prefix instead of scanning the whole bucket, and it keeps lifecycle rules easy to target.

Costs: S3 pricing is genuinely low but not zero. You pay for storage (roughly a few cents per GB per month for Standard), for requests (PUT/GET calls in tiny fractions of a cent each), and for data transfer out to the internet. Uploads (transfer in) are free. For most automation workloads — thousands of files a month — you're looking at cents to a couple of dollars. The two things that surprise people are lots of tiny frequent requests and heavy download traffic, so batch where you can and lean on presigned URLs rather than proxying downloads through your own server.

Wrapping up

Connecting n8n to AWS S3 comes down to four things: a least-privilege IAM user, an AWS credential in n8n with the right region, matching the binary property between your producer node and the S3 Upload node, and thoughtful key/prefix naming. With those in place you can automate file storage, backups, and sharing without ever touching the S3 console again.

Ready to automate? Get this template on Gumroad →