---
title: "Start connecting an S3 bucket with one click"
method: POST
path: "/storage/aws/prepare"
tags: ["Storage"]
---

# Start connecting an S3 bucket with one click

`POST /storage/aws/prepare`

Creates a pending connection and returns a CloudFormation quick-create link. The stack makes a role that trusts Rendobar's own OpenID issuer for this connection alone and reports back; no access keys exist anywhere. The response also carries the trust policy and Terraform for a hand-made role, finished with a PATCH carrying the role ARN.

## Request body

- object
  - `id` string, required
  - `bucket` string, required
  - `region` string
  - `publicBaseUrl` string, uri
  - `createBucket` boolean
  - `access` 'deliver' | 'read'

## Response `201`

Pending

- object
  - `data` object, required
    - `bucket` string, required
    - `publicBaseUrl` string, uri
    - `endpoint` string, uri, required
    - `region` string, required
    - `pathStyle` boolean, required
    - `accountId` string
    - `jurisdiction` 'eu' | 'fedramp' | 'us'
    - `projectRef` string
    - `expiresOn` number
    - `pending` true
    - `auth` 'role'
    - `access` 'read'
    - `problem` object
      - `at` number, required
      - `message` string, required
    - `pathTemplate` string
    - `onConflict` 'suffix' | 'replace'
    - `defaultDestination` true
    - `conditionalWrites` boolean
    - `id` string, required
    - `provider` string, required
    - `createdAt` number, required
    - `updatedAt` number, required
    - `deliverySummary` object
      - `jobsLast30d` integer, required
      - `bytesLast30d` integer, required
      - `lastAt` number, nullable, required
      - `lastStatus` 'delivered' | 'failed' | 'null', nullable, required
      - `lastReason` 'destination_denied' | 'signature_mismatch' | 'bucket_not_found' | 'object_too_large' | 'already_exists' | 'destination_unavailable' | 'not_deliverable' | 'null', nullable, required
    - `checks` object[]
      - `name` 'write' | 'read' | 'delete' | 'list', required
      - `status` 'passed' | 'failed' | 'skipped', required
      - `reason` 'destination_denied' | 'signature_mismatch' | 'bucket_not_found' | 'object_too_large' | 'already_exists' | 'destination_unavailable' | 'not_deliverable'
      - `message` string
    - `subject` string, required
    - `issuer` string, required
    - `audience` string, required
    - `quickCreateUrl` string, required
    - `trustPolicy` string, required
    - `terraform` string, required

## Other responses

- `400` — Invalid body
- `401` — Unauthorized
- `403` — Missing scope or role
- `409` — An id already exists
- `503` — One-click AWS connect is not set up on this deployment

## Changes

- **2026-09-13** `e2df91eff7a2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rendobar/apis/rendobar-api/changes/storage/aws/prepare/post.md)

---

[API](https://skmtc.dev/rendobar/apis/rendobar-api.md) · [All operations](https://skmtc.dev/rendobar/apis/rendobar-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rendobar/apis/rendobar-api/revisions/420f0f5209ca?raw)