Skip to content
Please update to the latest release 0.77.2 to address Multiple CVEs.

s3

Accessor
Arg Description Type
secret The name of a secret to use. string
region The region. string
credentials_key string
credentials_secret string
credentials_token string
endpoint string
skip_verify bool

Required permissions: NETWORK

Description

Allows access to S3 buckets.

  1. The first component is interpreted as the bucket name.

  2. Provide credentials through the VQL environment variable S3_CREDENTIALS. This should be a dict with a key of the bucket name and the value being the credentials.

Example

LET S3_CREDENTIALS<=dict(endpoint='http://127.0.0.1:4566/',
  credentials_key='admin',
  credentials_secret='password',
  no_verify_cert=1)

SELECT *, read_file(filename=OSPath,
   length=10, accessor='s3') AS Data
FROM glob(
   globs='/velociraptor/orgs/root/clients/C.39a107c4c58c5efa/collections/*/uploads/auto/*',
   accessor='s3')

Notes

It is more convenient to use the secrets support introduced in version 0.72 to manage these credentials.