AWS Download
CertifiedDownload objects from S3
AWS Download
Download objects from S3
Single-file mode when only key is set; multi-file mode when prefix/delimiter/regexp are provided. Saves downloads to internal storage and returns metadata per object.
type: io.kestra.plugin.aws.s3.DownloadExamples
id: aws_s3_download
namespace: company.team
tasks:
- id: download
type: io.kestra.plugin.aws.s3.Download
accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
secretKeyId: "{{ secret('AWS_SECRET_KEY_ID') }}"
region: "eu-central-1"
bucket: "my-bucket"
key: "path/to/file"
Download a file and verify the stored S3 checksum during transfer
id: aws_s3_download_validate_checksum
namespace: company.team
tasks:
- id: download
type: io.kestra.plugin.aws.s3.Download
accessKeyId: "{{ secret('AWS_ACCESS_KEY_ID') }}"
secretKeyId: "{{ secret('AWS_SECRET_KEY_ID') }}"
region: "eu-central-1"
bucket: "my-bucket"
key: "path/to/file"
validateChecksum: true
Properties
bucket *Requiredstring
The S3 bucket name
accessKeyId string
Access Key Id in order to connect to AWS
If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
compatibilityMode booleanstring
falseCompatibility mode
Use default async client (limits transfers to ~2GB) for S3-compatible endpoints.
delimiter string
Delimiter
Groups keys up to the delimiter; enables multi-file mode.
endpointOverride string
The endpoint with which the SDK should communicate
This property allows you to use a different S3 compatible storage backend.
expectedBucketOwner string
The account ID of the expected bucket owner
Requests will fail with a Forbidden error (access denied) if the bucket is owned by a different account.
forcePathStyle booleanstring
Force path style access
Must only be used when compatibilityMode is enabled.
key string
Object key
Key to download in single-file mode.
marker string
Marker
Pagination start key for multi-file mode.
maxFiles integerstring
25Max files
Limit returned files in multi-file mode; default 25.
maxKeys integerstring
1000Max keys
Maximum keys per list request in multi-file mode; default 1000.
pluginDefaultsRef Non-dynamicstring
Reference (ref) of the pluginDefaults to apply to this task.
prefix string
Prefix filter
Enables multi-file mode; downloads keys starting with this prefix.
regexp string
Regexp filter
Regex on keys; enables multi-file mode.
region string
AWS region with which the SDK should communicate
requestPayer string
Sets the value of the RequestPayer property for this object
secretKeyId string
Secret Key Id in order to connect to AWS
If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
sessionToken string
AWS session token, retrieved from an AWS token service, used for authenticating that this user has received temporary permissions to access a given resource
If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
stsEndpointOverride string
The AWS STS endpoint with which the SDKClient should communicate
stsRoleArn string
AWS STS Role
The Amazon Resource Name (ARN) of the role to assume. If set the task will use the StsAssumeRoleCredentialsProvider. If no credentials are defined, we will use the default credentials provider chain to fetch credentials.
stsRoleExternalId string
AWS STS External Id
A unique identifier that might be required when you assume a role in another account. This property is only used when an stsRoleArn is defined.
stsRoleSessionDuration string
PT15MAWS STS Session duration
The duration of the role session (default: 15 minutes, i.e., PT15M). This property is only used when an stsRoleArn is defined.
stsRoleSessionName string
AWS STS Session name
This property is only used when an stsRoleArn is defined.
validateChecksum booleanstring
falseValidate checksum after download
When true, requests S3 to return the stored checksum and the AWS SDK verifies the downloaded bytes during transfer. The object must have been uploaded with a checksum algorithm (SHA1, SHA256, CRC32, or CRC32C) for verification to occur; if the object has no stored checksum, a warning is logged and the download is not verified.
versionId string
Version ID
Specific version to fetch in single-file mode.
Outputs
checksumAlgorithm string
Checksum algorithm reported by S3
One of SHA1, SHA256, CRC32, CRC32C. Null when validateChecksum was not enabled or the object has no stored checksum.
checksumValue string
Checksum value reported by S3 (base64-encoded)
Populated when validateChecksum is true and the object has a stored checksum.
contentLength integer
Content length (bytes)
contentType string
Content type
files object
Files
Per-key file info when multi-file mode is used.
io.kestra.plugin.aws.s3.models.FileInfo
Checksum algorithm reported by S3
One of SHA1, SHA256, CRC32, CRC32C. Null when validateChecksum was not enabled or the object has no stored checksum.
Checksum value reported by S3 (base64-encoded)
Populated when validateChecksum is true and the object has a stored checksum.
The size of the file in bytes
The MIME type of the file
An ETag is an opaque identifier assigned by a web server to a specific version of a resource found at a URL
The metadata of the file
uriThe URI of the downloaded file in Kestra's storage
The version ID of the file
metadata object
Metadata
uri string
uriUri
versionId string
The version of the object
Metrics
file.size counter
bytesThe size of the downloaded file.
