Skip to main content

Connect an external S3 Storage

Connect an AWS, CloudFerro, OVH or other S3-compatible bucket to an EDITO personal or project space and make it available to services and File Explorer.

Context

You can connect a public or private S3-compatible bucket to EDITO and use it alongside, or instead of, the default EDITO storage.

Connecting an external bucket is useful when:

  • Your organization already stores data with another provider;

  • A project needs more capacity than the default EDITO quota;

  • A processing workflow must read or write an existing external bucket;

  • You want File Explorer and EDITO services to use a public S3 data source;

  • Partners need to exchange data through a bucket that they can access independently of EDITO.

EDITO can connect to AWS, OVH, CloudFerro and other services that implement a compatible S3 API.

The external provider remains responsible for the bucket's capacity, availability, billing, lifecycle rules and credentials.

Before you start

Collect the values required:

  • A display name for the EDITO configuration;

  • S3 endpoint or endpoint URL;

  • Region, if required;

  • Working-directory path or prefix, if the configuration should be restricted to part of a bucket;

  • Access Key ID and Secret Access Key for a private bucket;

  • Session token, if the provider uses temporary credentials;

  • Whether the bucket can be accessed anonymously;

  • Whether this bucket should be displayed in File Explorer.

For a public bucket, credentials may not be required.


​

Add an external bucket in Project Settings

1. Select the personal or group-project space in which the configuration must be available.

2. Open Project Settings (1)

3. Stay on S3 Configurations

4. Select Add a custom S3 configuration (2)

5. Enter the endpoint, bucket or working path, region and any other requested values.

6. Choose the appropriate access mode:

- Enable Anonymous for a public bucket that does not require credentials;

- Enter the access credentials for a private bucket.

7. Enable Use for EDITO explorers if this bucket should be shown in File Explorer.

8. Save the configuration.

9. Open File Explorer to verify that the expected content is visible.


​

Connect a public bucket

Enable Anonymous when the bucket or prefix allows unauthenticated read access.

This can be used for:

  • Public data hosted by an external S3 provider;

  • A public path from another EDITO project bucket;

  • A public dataset that should be browsed without storing credentials in the project configuration.

The external bucket policy must already permit the required anonymous operations. Enabling Anonymous in EDITO does not make a private external bucket public by itself.

If the public source supports read-only access, treat it as a data source rather than a writable workspace.


​

Connect a private bucket

For a private bucket, provide the credentials issued by the bucket owner or provider.

A configuration may include:

  • Endpoint URL

  • Region

  • Bucket name

  • Working-directory path

  • Access Key ID

  • Secret Access Key

  • Session token, when required

The configured identity must have permission to perform the operations expected from EDITO. For example:

  • Read-only access for a reference dataset;

  • Read and write access for a project workspace;

  • Write access restricted to an ingestion prefix;

  • Delete access only when it is operationally necessary.

Use the least-privilege principle. Do not reuse an administrator key when a restricted application key is sufficient.


​

Choose which bucket appears in File Explorer

Enable Use for EDITO explorers on the configuration that should be visible in File Explorer.

⚠️ If several S3 configurations exist in the same personal or project space, File Explorer displays only the configuration selected for EDITO explorers.

Changing this option changes which bucket is browsed graphically. It does not delete or disconnect the other configurations, which can still be used by services and processes when selected in their launch forms.


​

Use an external bucket in a group project

Some group projects have both:

  • The default EDITO MinIO bucket;

  • An additional external bucket with higher capacity, hosted by CloudFerro.

Depending on the configuration, you may see names such as:

  • s3/PROJECT_NAME-bucket

  • s3/project-PROJECT_NAME

In order to see the settings of the configurations click on Edit for example s3.waw3-1.cloudferro.com, and record:

  • URL;

  • Working directory path;

  • Access Key ID;

  • Secret Access Key.

📌 Note: project settings are shared with all members of the group. A new S3 configuration (other than the two provided by EDITO) added there becomes available to all project members.

⚠️ Review who is allowed to read or modify the external credentials before adding them to a group project. We strongly recommend that you do not edit the S3 configurations for the external buckets created by the EDITO team and hosted by CloudFerro. To use them, simply retrieve the information listed above and do not edit anything.


Configure MinIO Client for the external bucket

When the external credentials are static and do not use a session token, create an alias:

mc alias set ALIAS URL ACCESS_KEY SECRET_KEY

Replace:

  • ALIAS with a name chosen for local commands, for example cf_external;

  • URL with the external endpoint URL;

  • ACCESS_KEY and SECRET_KEY with the provider credentials.

Example:

mc alias set cf_external https://s3.waw3-1.cloudferro.com ACCESS_KEY SECRET_KEY

Verify the connection:

mc ls cf_external

Then include the bucket name and optional working-directory path in object commands: cf_external/<BUCKET>/<WORKING_PATH>/...


For temporary credentials that include a session token, configure MC_HOST_<ALIAS> instead (see Transfer data between your computer or cluster and EDITO).

Use the external bucket from an EDITO service or process

When launching a compatible service or process:
​

1. Open its S3 configuration section;

2. Select or retain the external configuration inherited from Project Settings;

3. Launch the service or process;

4. Inspect the injected variables with:

env | grep -E 'AWS|S3|MC_HOST'

Use the same boto3, s3fs, xarray or mc patterns as for EDITO storage. The endpoint, bucket and credentials are different, but the S3 operations are equivalent.

💡 See Access EDITO storage from code, services and processes.


Give partners direct access to a private external bucket

Even if your project has added a storage bucket on EDITO to facilitate collaboration, users do not need an EDITO account to access it; they only require the credentials.

This means a partner can upload or download data without using the EDITO Datalab if the bucket owner gives them suitable credentials.


Before sharing credentials (when applicable):

  • Create a dedicated identity rather than sharing an administrator key;

  • Restrict access to the required bucket or prefix;

  • Grant only the required actions;

  • Set an expiration date when possible;

  • Use a secure channel to transmit the secret;

  • Rotate or revoke the credentials when the collaboration ends.

If several partners need access, issue separate credentials where possible so that access can be audited and revoked independently.

Public and private access are separate from EDITO membership

EDITO project membership controls access to the project's Datalab context. The external provider's bucket policy controls direct S3 access.


As a result:

  • An EDITO project member may still receive AccessDenied if the configured S3 credential lacks permission;

  • A person without an EDITO account may access the bucket directly if they have valid external credentials;

  • A public bucket may be readable without either EDITO membership or credentials.

⚠️ To use a project bucket hosted on CloudFerro, a user does not need to have an EDITO account: they simply need the bucket credentials.


Security recommendations (for external private buckets)

  • Use dedicated application credentials rather than personal administrator credentials.

  • Restrict policies to the minimum bucket, prefix and actions.

  • Avoid storing credentials in notebooks, Git repositories or shared shell scripts.

  • Rotate credentials after accidental exposure.

  • Remove obsolete configurations from Project Settings.

  • Review access when a member leaves a group project.

  • Do not enable anonymous access unless the source is intentionally public.

  • Check whether write or delete permissions are truly required.

  • Confirm that the endpoint uses HTTPS.

Troubleshooting

The bucket does not appear in File Explorer

Check that:

  • The configuration was saved in the currently selected personal or project space;

  • Use for EDITO explorers is enabled on that configuration;

  • Another configuration has not replaced it as the explorer source;

  • The endpoint, bucket and working-directory path are correct.

An anonymous public bucket returns AccessDenied

The external bucket or prefix may not actually allow anonymous reads. Confirm the provider-side bucket policy. The EDITO Anonymous option does not override the provider's access policy.

A private bucket returns AccessDenied

Check the access-key policy, bucket name, prefix and requested operation. Read access does not imply write or delete access.


The endpoint cannot be reached

Check:

  • The complete endpoint URL;

  • The HTTPS certificate;

  • Network or firewall restrictions;

  • Whether the provider requires a region-specific endpoint;

  • Whether the bucket uses path-style or virtual-host-style addressing supported by the selected client.

The service uses the wrong bucket

Open the launch form and inspect its S3 configuration. A saved service configuration may retain an older selection even after Project Settings change.

What's next?

If you have any questions, problems, or suggestions, please feel free to contact us via chat using the widget available at the bottom right of the page.

Did this answer your question?

Related Articles

EDITO Help Center
This page is currently being created and is constantly evolving to cover as many topics as possible.

Funded by the European Union