---
title: "open connection · RUAL Documentation"
description: "Opens a connection to S3-compatible object storage (Ceph RGW, MinIO, Amazon S3). Point it at an object storage service provider so the secret key stays…"
canonical: https://docs.rual.nl/block-types/object%20storage/s3connection_open
language: en
---

[Cluster](https://docs.rual.nl/cluster)

[Blocks](https://docs.rual.nl/block-types)

[Interfaces](https://docs.rual.nl/interfaces)

[Blueprints](https://docs.rual.nl/blueprints)

[Tutorials](https://docs.rual.nl/tutorials)

[Home automation](https://docs.rual.nl/home-automation)

[Examples](https://docs.rual.nl/examples)

[Reference](https://docs.rual.nl/reference)

[Architecture](https://docs.rual.nl/architecture)

[Troubleshooting](https://docs.rual.nl/troubleshooting)

Other

# open connection

This block is part of the [`object storage`](https://docs.rual.nl/block-types/object%20storage) group and was last modified in core [`v15.0.1`](https://docs.rual.nl/core-versions/150001).

Opens a connection to S3-compatible object storage (Ceph RGW, MinIO, Amazon S3). Point it at an **object storage service provider** so the secret key stays in the provider store and never appears in this blueprint : the key pins are the older way and leave the secret readable to anyone who can open the flow.

- flow `flow`

- endpoint `value` Gateway URL, for example `https://rgw.example.com` or `http://10.0.0.5:8080`. A bare hostname is assumed https. Required unless the provider supplies one. An endpoint on a private or internal address must be added to the `http_outbound_allowlist` cluster setting, or calls on this connection are refused.

- provider `value` Name of an object storage service provider (Settings → Service Providers). Preferred: the keys are resolved when a call is made and never land on a pin.

- access key id `value` Literal access key. Only used when no provider is named. Stored in plaintext in this blueprint.

- secret access key `value` Literal secret key. Only used when no provider is named. Stored in plaintext in this blueprint.

- session token `value` Optional. Only for temporary (STS-issued) credentials; Ceph RGW does not issue them.

- region `value` Signing region. Defaults to `us-east-1`, which RGW accepts and ignores unless it is configured with zonegroups.

- default bucket `value` Optional. Used by every block on this connection that leaves its own bucket pin empty.

- path style addressing `condition` On (the default) puts the bucket in the URL path : required for Ceph RGW and MinIO. Off uses `bucket.host` virtual-host addressing, which needs a wildcard DNS entry and matching certificate.

Default `true`

- flow `flow`

- connection `s3connection` The same connection, so it can be passed to the next block.

- success `condition` False when no credential was given, the endpoint is missing or malformed, or the named provider does not exist, is disabled, or is not an object storage provider.

- error `value`

Opens an S3-compatible object storage connection and emits it on `connection`. Makes NO network call : it only validates and normalizes, so a wrong endpoint or a down gateway surfaces at the first block that uses the connection, not here. Credentials come one of two ways and they are not equivalent: `provider` names an object_storage service provider and the connection carries only that NAME (the secret is fetched per call and never lands on a pin or in a simulation trace : use this), while `access_key_id`+`secret_access_key` embed literal keys in the blueprint in plaintext. `endpoint` is required unless the named provider supplies one. `path_style` defaults to TRUE (bucket in the URL path), which is what Ceph RGW and MinIO need; set it false only for Amazon S3-style virtual-host addressing, which requires a wildcard DNS entry per bucket. `bucket` here is a DEFAULT that every downstream block inherits when its own bucket pin is empty. success=false with error NO_CREDENTIAL, MISSING_ENDPOINT, or a PROVIDER_* code when the connection cannot be built; `connection` is then null. DEPLOYMENT: outbound calls go through the cluster SSRF guard, which refuses loopback, private and link-local addresses. An RGW on an internal range must have its address added to the `http_outbound_allowlist` cluster setting (Cluster Settings → HTTP → Outbound Allowlist) first, or every operation fails with a blocked-address error even though the credentials are correct.

| `s3` |
| --- |
| `rgw` |
| `ceph` |
| `minio` |
| `object storage` |
| `bucket` |
| `blob` |

## Version history

Introduced in [`v15.0.1`](https://docs.rual.nl/core-versions/150001).

## Service documentation

- [External API reference](https://docs.ceph.com/en/latest/radosgw/s3/): This block wraps a third-party service. Click here for the service's own documentation of the underlying endpoint.

- [Back to `object storage`](https://docs.rual.nl/block-types/object%20storage): Return to the main group to view all sub-groups

- [Back to `object storage`](https://docs.rual.nl/block-types/object%20storage?group=object%20storage): Return to the group to view all blocks within this group

Was this page helpful? [Tell us what to improve](https://docs.rual.nl/support) · RUAL Docs is an integral component of the [RUAL ecosystem](https://rual.nl)