S3 destination

The s3 destination writes events to Amazon S3 or any S3-compatible object storage (MinIO, Cloudflare R2, etc.) in batches.

Configuration

{
  "destinations": {
    "archive": {
      "type": "s3",
      "bucketName": "my-log-archive",
      "bucketRegion": "us-west-2"
    }
  }
}

Options

Option	Type	Default	Description
`bucketName`	string	required	S3 bucket name
`bucketRegion`	string	required	AWS region (e.g. `"us-west-2"`)
`pathPrefix`	string	`""`	Key prefix for objects (e.g. `"logs/"`)
`customEndpoint`	string	`""`	Custom S3 endpoint for S3-compatible services
`accessKeyID`	string	`""`	AWS access key ID
`secretAccessKey`	string	`""`	AWS secret access key
`batchSize`	int	`100`	Events per batch

Authentication

Reveald uses the AWS SDK for S3 access. Credentials are resolved in this order:

accessKeyID and secretAccessKey in the config file
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables
IAM instance role (EC2, ECS, EKS)

On AWS infrastructure (EC2, ECS, EKS), use IAM roles instead of static credentials. This is more secure and doesn't require credential rotation.

Examples

S3-compatible storage (MinIO, R2)

{
  "destinations": {
    "minio": {
      "type": "s3",
      "bucketName": "logs",
      "bucketRegion": "us-east-1",
      "customEndpoint": "https://minio.internal:9000",
      "accessKeyID": "$MINIO_ACCESS_KEY",
      "secretAccessKey": "$MINIO_SECRET_KEY"
    }
  }
}

With path prefix

{
  "destinations": {
    "s3": {
      "type": "s3",
      "bucketName": "company-logs",
      "bucketRegion": "us-west-2",
      "pathPrefix": "reveald/production/",
      "batchSize": 100000
    }
  }
}