Queues and storage

The screenshots show native unsaved, disabled setup forms. Credential secrets are empty; destinations are fictional and entered domains are deliberately non-resolving. No connector was saved or tested, no AWS identity was verified, and no message or object was written.

Amazon S3 (s3)

Static-key and assume-role modes support region, credentials/role, external ID, optional bucket, and key prefix. The tool writes one object, generating a timestamped key when omitted. Grant only s3:PutObject to the intended prefix.

Amazon S3 keys mode — unsaved bucket and prefix. Native UNSAVED setup shows region, empty access-key and session-token fields, and fictional bucket and key-prefix defaults. Enabled is off. These are destination inputs, not a bucket-policy or encryption editor; no STS call, PutObject authorization check, or object write occurred. Synthetic example data; names, identifiers and measurements do not describe a live tenant. View full-size screenshot.

Amazon SQS (sqs)

Static-key and assume-role modes support optional default queue URL. The tool sends a JSON/text message. FIFO queues require a group ID and can use a deduplication ID. Grant only sqs:SendMessage on the target queue.

Amazon SQS keys mode — unsaved queue fields. Access key ID, secret access key, and optional session token are empty; Enabled is off. The UNSAVED default queue URL uses a non-resolving .invalid domain, not a valid AWS destination. FIFO group and deduplication IDs are call-time arguments, not controls in this form; no queue was contacted. Synthetic example data; names, identifiers and measurements do not describe a live tenant. View full-size screenshot.

Azure Service Bus (servicebus)

Use a connection string or namespace plus SAS policy name/key, with optional default queue. The tool sends one message and optional subject. Create a SAS policy limited to Send on the intended queue rather than namespace management authority.

Service Bus connection-string mode — unsaved setup. The entire connection-string credential remains blank; the visible example text is a placeholder. Only a fictional default queue is entered and Enabled is off. This UNSAVED mode has no separate namespace or SAS-key inputs, and no configuration test or message send occurred. Synthetic example data; names, identifiers and measurements do not describe a live tenant. View full-size screenshot.

AWS Security Hub

Security Hub is documented under SIEM & Security Destinations.

Safety and limitations

These connectors create durable external data and are not offered a generic Send test. Health probes verify configuration or identity without writing. Validate with a dedicated test queue/bucket through an approved run, configure lifecycle/dead-letter/retention policies at the destination, and avoid secrets in message bodies.

Related pages

• Queue and storage setup, including role and SAS modes
• Approvals
• Auditing