Cloud Connectors ENT

Administrator Guide — connecting Slim Archiver to Amazon S3 (and S3-compatible object storage) to browse, upload, download, and archive directly to the cloud.

Audience: IT / security administrators · Applies to: Slim Archiver Enterprise.

What the cloud connector does

The Cloud Connect workspace adds a two-pane file browser: your local file system on one side and your cloud bucket on the other. You can browse the bucket, upload and download objects, and — from the Compress screen — build an archive and send it straight to the cloud with Create & Upload to Cloud.

1. What is supported

Slim Archiver's cloud connector speaks the Amazon S3 protocol. It authenticates with AWS Signature Version 4 and addresses objects in path-style form (endpoint/bucket/key).

Amazon S3 and S3-compatible storage

The connector is built for Amazon S3. Because it uses a configurable endpoint and path-style addressing, S3-compatible object stores that accept the same protocol (for example MinIO, Wasabi, Cloudflare R2, Backblaze B2) can generally be used by pointing the endpoint at their S3 API. These are used at your own discretion — Amazon S3 is the supported, tested target.

Requires an active Enterprise license. Cloud operations also respect SSO enforcement: if your policy requires corporate sign-in, cloud actions are gated behind it (see the SSO / CAC guide).

2. Connecting to a bucket

Open the Cloud Connect workspace and create a connection profile with these fields:

Field	Required	Value
Endpoint	yes	The S3 API endpoint URL. For AWS, the regional S3 endpoint; for compatible services, that service's S3 endpoint. A trailing slash is ignored.
Bucket	yes	The target bucket name.
Access Key	yes	The access key ID for an account/role with access to the bucket.
Secret Key	yes	The corresponding secret access key.
Region	no	The AWS region. Defaults to `us-east-1` if not set. Use the bucket's real region for correct signing.

On save, Slim Archiver performs a quick listing to verify the credentials and endpoint before storing the profile. A failure here means the endpoint, bucket, keys, or region is wrong.

Use least-privilege credentialsGrant the access key only the permissions it needs on the specific bucket/prefix used for archiving (typically list, get, put, and delete on that bucket). Avoid using root or broadly-scoped account keys.

3. Browsing, uploading, downloading

The bucket pane lists folders and objects, with navigation into prefixes and back up to the parent. Large listings are paginated automatically.
New Folder creates an empty folder (a zero-byte marker object) in the current location.
Upload a local file to the current bucket location, and download an object to a local folder.
Delete removes an object from the bucket. Deletion is permanent on the storage side — confirm before deleting.
Transfers retry briefly on transient network errors or storage 5xx responses, so a short blip does not abort a large transfer.

3.1 Shareable links (Get Link)

Get Link generates a temporary, pre-signed download URL for a selected object. Anyone with the link can download that object until it expires — no account or credentials required. The link defaults to 1 hour and can be set up to a maximum of 7 days.

A shareable link is time-limited public accessA pre-signed link grants download access to anyone who has it for its lifetime. Share it only with intended recipients, prefer the shortest expiry that works, and remember it cannot be revoked before it expires (short of removing the object). Link generation is recorded in the audit log.

3.2 Saved connections

You can save a connection as a named profile (“Remember this connection”) and reconnect to it later from the Saved connections list, rather than re-entering the endpoint and keys each time. Profiles can be selected, connected, or deleted from that list.

4. Archiving directly to the cloud

On the Compress screen, Enterprise users see Create & Upload to Cloud next to the normal Create Archive action. This builds the archive with your chosen settings and uploads it to the connected bucket in one step — the same compression, encryption, and (Pro) SFX/split options apply.

Encryption still appliesUploading to the cloud does not change encryption: if you set a password (or CAC), the archive is encrypted locally before it is uploaded, so the object stored in the bucket is already encrypted.

5. Security notes

Requests are signed with AWS Signature Version 4; credentials are used to sign requests, not sent in the clear.
Use HTTPS endpoints so traffic to the storage service is encrypted in transit.
Grant least-privilege keys scoped to the archiving bucket/prefix, and rotate them per your normal policy; update the connection profile when you rotate.
Cloud actions honor the Enterprise license and, when configured, SSO enforcement — a signed-out user under an SSO-required policy cannot perform cloud operations.
Shareable links grant time-limited download access to whoever holds them; use short expiries and share carefully (see section 3.1).
Saved connections store credentials so a profile can reconnect without re-entry; treat saved profiles as sensitive and remove them when a key is retired.

Endpoint is admin-suppliedThe endpoint you enter is used as-is to reach your storage. Point it only at storage endpoints you control or trust, and prefer HTTPS. Treat the connection profile (which references your keys) as sensitive configuration.

6. Troubleshooting

Symptom	Meaning & fix
Connection check fails on save	Endpoint, bucket, keys, or region is wrong. Verify each; confirm the key can list the bucket.
Signature / auth errors	Usually a wrong region (SigV4 signs with the region) or an incorrect secret key. Set the bucket's real region.
Listing works but upload/download fails	The key lacks put/get permission on the bucket/prefix. Grant the needed actions.
Cloud actions are blocked	Confirm an active Enterprise license; if SSO is enforced, sign in first (see the SSO/CAC guide).
S3-compatible service won't connect	Confirm the service's S3 endpoint and that it accepts path-style, SigV4 requests; set the region it expects.