Connect to an S3 bucket

The article explains how to create an S3 bucket connection.

Step 1. Create and configure a connection

Open the New cloud storage connection dialog.
1. On the Home page, select the workspace where you want to add a cloud storage connection.
2. In the expanded list of workspace resources, select Data and switch to the Cloud storage tab.
3. Click New cloud storage connection at the top right.
1. In the sidebar, select Attached data and switch to the Cloud storage tab.
2. At the bottom of the tab, click New cloud storage
In the New cloud storage connection dialog, select Amazon S3.
In the New Amazon S3 cloud storage connection dialog, fill in the following fields:
- Display name: to specify the name for this data source in your system
- Use default credentials: select this option to authenticate with the credentials provided by the workspace service account instead of entering access keys. See Use default credentials for details.
- AWS access key and AWS secret access key
  These fields are hidden when Use default credentials is enabled.
- Region: to specify your AWS region
- Amazon Bucket name: to specify the name of the bucket you want to mount
- Custom options: to specify additional parameters. See the example below
  You can use the endpoint_url parameter to connect to other bucket providers from this list.
  When using an IAM role associated with Datalore for authentication, httpPutResponseHopLimit>1 is required.
- Custom endpoint URL: to specify the website of the bucket you want to mount
(Optional) Click the Test connection button to make sure the provided parameters are correct.
The Test connection button is disabled when Use default credentials is enabled. In this mode the credentials are validated on first use, when the connection is mounted to a notebook.
Click the Create and close button to finish the procedure.

Step 2. Configure optional parameters for S3 data sources

Use the Custom_options field for optional parameters when creating an Amazon S3 data source. Below are two examples of how it can be used.

To enable SSE-C for S3 data sources, specify the following in the Custom_options: In the Custom_options field, specify the following:
use_sse=c:/path/to/keys/file
where:
/path/to/keys/file is the file that contain keys. Make sure permissions are 600.
(For Datalore On-Premises only) To provide access based on a role associated with that of an EC2 instance profile, add public_bucket=0,iam_role into the Custom_options field.

Step 3. Attach the connection to a notebook

Open the notebook you want to attach the connection to.
If the notebook is not running, start it by clicking Run | Start machine.
In the sidebar, select Attached data and switch to the Cloud storage tab.
Enable the toggle in your S3 connection.

If the notebook is not running, start it by clicking Run | Start machine.
In the sidebar, select Attached data and switch to the Cloud storage tab.
Enable the toggle in your S3 connection.

Step 4. Use the connection in the notebook

After the connection is mounted, you can access files in the S3 bucket from your notebook code:

import pandas as pd

df = pd.read_csv("/data/s3/my_file.csv")
df
      

%use dataframe

val df = DataFrame.readCsv("/data/s3/my_file.csv")
df
      

val lines = scala.io.Source.fromFile("/data/s3/my_file.txt").mkString

df <- read.csv("/data/s3/my_file.csv")

print(df)

The connection’s mount path, such as /data/s3/, is shown on the connection card. To copy the path, click ∙∙∙ | Copy directory path.

Use default credentials

Instead of providing an access key and secret access key, you can enable Use default credentials to authenticate the connection with the credentials provided by the workspace service account.

This is useful when Datalore runs with an ambient IAM identity provided by the underlying platform, so the bucket is accessed without storing long-lived access keys. The identity is resolved from the workspace service account, which is bound to a cloud IAM role.

The exact mechanism depends on where Datalore runs:

On AWS, use IAM roles for service accounts (IRSA) or EKS Pod Identity to associate an IAM role with the Kubernetes service account.
On Google Cloud, use Workload Identity Federation for GKE to let the Kubernetes service account impersonate a Google Cloud service account.

Configure the service account

Click your avatar at the top right and select Admin panel.
In the sidebar, select Manage workspaces
Next to the workspace where you want to add a service account, click (More) and select Edit identity bindings.
In the dialog, enter the service account name in K8s agent service account and click Save.

Next steps

Learn how to manage and delete cloud storage connections in a workspace and in a notebook.

19 August 2026