Set up S3 storage

Private documents for Allin jobs and agents.

1. Choose an existing bucket, its region and a dedicated prefix such as allin/. Keep AWS Block Public Access enabled.
2. In IAM, create a dedicated user with a policy restricted to these buckets and prefixes. Generate an access key for Allin.
3. In Allin → Settings → S3 storage, enter the credentials and buckets. Discovery is optional and requires s3:ListAllMyBuckets.
4. Copy the generated policy into IAM. If using a KMS key, its key policy must also authorize this identity.
5. Select people, teams and agents allowed to read or publish. Permissions cover resources across all jobs in this workspace.
6. Save and test listing. This does not prove GetObject or PutObject access: verify those through a first publication and read.

Example policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation"
      ],
      "Resource": "arn:aws:s3:::your-private-bucket"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::your-private-bucket",
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "allin/",
            "allin/*"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::your-private-bucket/allin/*"
    }
  ]
}

Agent usage

Tools are exposed on Allin MCP for authorized users and on worker MCP during authorized agent jobs. AWS keys are never sent to the worker.

list_resource_buckets → publish_job_resource → list_job_resources → read_job_resource
get_job_resource_download → URL (60 seconds)

Publish a UTF-8 .md, .txt, .json or .csv document up to 512 KiB. Supply content, a stable resourceId UUID and the current jobId. A local path does not transfer a file: the agent must read it first.

Share resourceId with other agents. Download links expire after 60 seconds; never post them in comments. Allin logs calls and link issuance, not each direct S3 download.

Files are immutable in Allin. Publish a new resource for a new version. Existing snapshots and sessions do not contain AWS keys.

AWS bills S3 and KMS usage to your account. This form creates no buckets or KMS keys.

Markdown · LLM