Cloud Connectors ENT

Administrator Guide — connecting Slim Archiver to Amazon S3 (and S3-compatible object storage) to browse, upload, download, and archive directly to the cloud.

Audience: IT / security administrators · Applies to: Slim Archiver Enterprise.

What the cloud connector does

The Cloud Connect workspace adds a two-pane file browser: your local file system on one side and your cloud bucket on the other. You can browse the bucket, upload and download objects, and — from the Compress screen — build an archive and send it straight to the cloud with Create & Upload to Cloud.

1. What is supported

Slim Archiver's cloud connector speaks the Amazon S3 protocol. It authenticates with AWS Signature Version 4 and addresses objects in path-style form (endpoint/bucket/key).

Amazon S3 and S3-compatible storage

The connector is built for Amazon S3. Because it uses a configurable endpoint and path-style addressing, S3-compatible object stores that accept the same protocol (for example MinIO, Wasabi, Cloudflare R2, Backblaze B2) can generally be used by pointing the endpoint at their S3 API. These are used at your own discretion — Amazon S3 is the supported, tested target.

Requires an active Enterprise license. Cloud operations also respect SSO enforcement: if your policy requires corporate sign-in, cloud actions are gated behind it (see the SSO / CAC guide).

2. Connecting to a bucket

Open the Cloud Connect workspace and create a connection profile with these fields:

Field	Required	Value
Endpoint	yes	The S3 API endpoint URL. For AWS, the regional S3 endpoint; for compatible services, that service's S3 endpoint. A trailing slash is ignored.
Bucket	yes	The target bucket name.
Access Key	yes	The access key ID for an account/role with access to the bucket.
Secret Key	yes	The corresponding secret access key.
Region	no	The AWS region. Defaults to `us-east-1` if not set. Use the bucket's real region for correct signing.

On save, Slim Archiver performs a quick listing to verify the credentials and endpoint before storing the profile. A failure here means the endpoint, bucket, keys, or region is wrong.

Use least-privilege credentialsGrant the access key only the permissions it needs on the specific bucket/prefix used for archiving (typically list, get, put, and delete on that bucket). Avoid using root or broadly-scoped account keys.

3. Browsing, uploading, downloading

The bucket pane lists folders and objects, with navigation into prefixes and back up to the parent. Large listings are paginated automatically.
New Folder creates an empty folder (a zero-byte marker object) in the current location.
Upload sends the selected local file to the current bucket location; a file over 100 MB is sent as a multipart upload in 16 MB parts. Download saves the selected object into the local folder shown in the other pane (see section 3.1).
Delete removes an object from the bucket. Deletion is permanent on the storage side — confirm before deleting.
Uploads and downloads retry a failed request up to 3 times (after about 1, 2 and 3 seconds) when the network fails, when a connection sends no data for 60 seconds, or when the storage answers 500, 502, 503 or 504; a multipart upload retries only the failed part. A short network drop therefore does not abort a large transfer.

3.1 How downloads work

If a file with the same name is already in the local folder, the app first asks Replace File?.
The object is written to a temporary file next to the target (<name>.<random>.part). It replaces the target only when it is complete and its size is checked; a failed or cancelled download deletes the temporary file and leaves an existing file unchanged.
An object of 100 MB or more is downloaded in 16 MB pieces over 4 connections at once, each a byte range of the same version of the object (checked with its ETag). A smaller object uses one connection. A cut piece is retried from its own start; a cut single-connection download continues where it stopped.
If the object is replaced in the cloud during the download, the download starts again and saves the new version. A storage service that does not support byte ranges (Range) and If-Match is downloaded over one connection from the start.

Choose the bucket's region near your usersDownload speed is usually limited by the network route between the bucket's region and the user, not by the app. In one measurement, a 527 Mbit/s home line downloaded from a bucket in eu-north-1 (Stockholm) at 13-15 MB/s over one connection and about 21 MB/s over four, while uploads to the same bucket reached 30-40 MB/s. A bucket in a region close to your users is the most effective way to speed up downloads.

3.2 Shareable links (Get Link)

Get Link generates a temporary, pre-signed download URL for a selected object. Anyone with the link can download that object until it expires — no account or credentials required. The link defaults to 1 hour and can be set up to a maximum of 7 days.

A shareable link is time-limited public accessA pre-signed link grants download access to anyone who has it for its lifetime. Share it only with intended recipients, prefer the shortest expiry that works, and remember it cannot be revoked before it expires (short of removing the object). Link generation is recorded in the audit log.

3.3 Saved connections

You can save a connection as a named profile (“Remember this connection”) and reconnect to it later from the Saved connections list, rather than re-entering the endpoint and keys each time. Profiles can be selected, connected, or deleted from that list.

4. Archiving directly to the cloud

On the Compress screen, Enterprise users see Create & Upload to Cloud next to the normal Create Archive action. This builds the archive with your chosen settings and uploads it to the connected bucket in one step — the same compression, encryption, and (Pro) SFX/split options apply.

Encryption still appliesUploading to the cloud does not change encryption: if you set a password (or CAC), the archive is encrypted locally before it is uploaded, so the object stored in the bucket is already encrypted.

5. Security notes

Requests are signed with AWS Signature Version 4; credentials are used to sign requests, not sent in the clear.
Use HTTPS endpoints so traffic to the storage service is encrypted in transit.
Grant least-privilege keys scoped to the archiving bucket/prefix, and rotate them per your normal policy; update the connection profile when you rotate.
Cloud actions honor the Enterprise license and, when configured, SSO enforcement — a signed-out user under an SSO-required policy cannot perform cloud operations.
Shareable links grant time-limited download access to whoever holds them; use short expiries and share carefully (see section 3.2).
Saved connections store credentials so a profile can reconnect without re-entry; treat saved profiles as sensitive and remove them when a key is retired.

Endpoint is admin-suppliedThe endpoint you enter is used as-is to reach your storage. Point it only at storage endpoints you control or trust, and prefer HTTPS. Treat the connection profile (which references your keys) as sensitive configuration.

6. Troubleshooting

Symptom	Meaning & fix
Connection check fails on save	Endpoint, bucket, keys, or region is wrong. Verify each; confirm the key can list the bucket.
Signature / auth errors	Usually a wrong region (SigV4 signs with the region) or an incorrect secret key. Set the bucket's real region.
Listing works but upload/download fails	The key lacks put/get permission on the bucket/prefix. Grant the needed actions.
Cloud actions are blocked	Confirm an active Enterprise license; if SSO is enforced, sign in first (see the SSO/CAC guide).
S3-compatible service won't connect	Confirm the service's S3 endpoint and that it accepts path-style, SigV4 requests; set the region it expects.
An error message or the “Cloud Storage Request Failed” card	The message carries the storage's own code and text, e.g. `S3 Download failed (HTTP 404): NoSuchKey: The specified key does not exist.` NoSuchKey: the object was deleted or renamed (refresh the list); AccessDenied: the key lacks the permission; SignatureDoesNotMatch: wrong secret key or region.
Downloads are much slower than uploads	The route from the bucket's region to the user limits each connection (see the note in section 3.1). Large objects already use 4 connections; a bucket region closer to the users helps most.
A download started again from 0%	The object was replaced in the cloud during the download, or the storage service ignores byte ranges; the new download is complete and correct.