Safeguard Docs
Compliance ConnectorsSetup by categoryCloud Storage Provider

Amazon S3

Connect Amazon S3 to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Connect Amazon S3 to collect cloud storage provider evidence automatically.

CategoryCloud Storage Provider
Connect withAPI token
What a connection producesAutomated evidence collection

Connect with an API token

  1. In Amazon S3:

    1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
    2. In the navigation pane, choose Users, then choose the user name (a dedicated user that has the AmazonS3ReadOnlyAccess AWS managed policy attached).
    3. On the Security credentials tab, in the Access keys section, choose Create access key.
    4. On the Access key best practices & alternatives page, choose Other, then choose Next.
    5. Optionally add a description tag on the Set description tag page, then select Create access key.
    6. On the Retrieve access key page, choose Show to reveal the secret access key, or choose Download .csv file. This is your only time to view or download it.
    7. Attach the AWS managed policy AmazonS3ReadOnlyAccess (s3:Get*, s3:List*, s3:Describe*) to the user, or to a group the user belongs to.

    Where to find the other values:

    • AWS Access Key ID: IAM console › Users › the user › Security credentials tab › Access keys lists the access key ID.

    Amazon S3 shows the secret only once, so copy it before you leave the page.

    Each IAM user can have two access keys. AmazonS3ReadOnlyAccess provides read-only access to all buckets. The policy-attach dialog itself (Add permissions) was not quoted from a fetched page; the managed policy reference page says it can be attached to users, groups and roles.

    Source: docs.aws.amazon.com, docs.aws.amazon.com, checked 2026-10-07.

  2. On Compliance › Connectors, open Amazon S3, click Connect, choose API token and fill in:

    FieldWhat to enter
    AWS Access Key IDRequired. Stored encrypted and never shown again.
    AWS Secret Access KeyRequired. Stored encrypted and never shown again.
    RegionOptional.
    Session token (optional)Stored encrypted and never shown again.

  3. Click Connect with token.

Frameworks

Safeguard's automated tests read Amazon S3 and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

FrameworkEvidenceControlsTests
SOC2Automated testsA1.1, A1.2, A1.3, C1.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC7.1, CC7.2, CC7.3, CC7.4, CC8.1148
ISO/IEC 27001Automated testsA.5.12, A.5.16, A.5.17, A.5.18, A.5.24, A.5.25, A.8.2, A.8.3, A.8.5, A.8.6, A.8.8, A.8.9, A.8.11, A.8.12, A.8.13, A.8.14, A.8.15, A.8.16, A.8.20, A.8.24, A.8.32148
HIPAA Security RuleAutomated tests164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1)81
PCI DSSAutomated tests1.3.1, 3.5.1, 3.7.4, 4.2.1, 6.3.1, 6.3.3, 6.4.2, 6.5.1, 7.2.1, 7.2.2, 8.2.6, 8.3.6, 8.4.1, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.5.1, 11.3.1, 11.5.1, 11.5.281
NIST CSF 2.0Automated testsDE.AE-02, DE.CM-01, DE.CM-09, ID.AM-07, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.IR-03, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02, RS.MA-01148
CIS AWS Foundations BenchmarkAutomated tests1.1, 1.2, 1.6, 1.7, 1.11, 1.13, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 2.1.1, 2.1.2, 2.1.3, 2.3.2, 2.4.1, 3.4, 3.8, 3.9, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 5.1, 5.4, 5.641

For a CIS benchmark, the numbers are its recommendations.

These tests are switched on per workspace by the Safeguard team.

Amazon CloudWatch, Amazon Web Services, AWS CodeCommit, AWS GovCloud, AWS Inspector, AWS Security Hub connect to the same provider as Amazon S3, and these tests run for a connection made through any of them.

Cloud Storage Provider connectors

The 21 Cloud Storage Provider connectors Safeguard connects to, how each one connects, and a setup page for each.

Azure Blob Storage

Connect Azure Blob Storage to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

On this page

Connect with an API tokenFrameworksRelated