Skip to main content
Connect an Amazon S3 bucket through a coding agent instead of assembling API requests and IAM policies by hand. The agent creates the project connector, creates a read-only IAM role in your AWS account that Fastino can assume, tests the connection, and starts an immutable dataset sync. You keep control of your bucket. Fastino imports selected data into your Fastino project without receiving your AWS access keys.

What you provide

You normally need only:
  • The bucket name and, optionally, a key prefix such as incoming/.
  • The Fastino project name or ID.
  • Whether the imported data is for training or evaluation.
The agent can read the bucket’s region and account from your authenticated AWS CLI session. It names the IAM role it creates, and connector and dataset names can default from the bucket name.

Before you start

  1. Connect your coding agent to your team’s Fastino MCP endpoint:
  2. Confirm the AWS CLI is authenticated to the account that owns the bucket:
  3. Confirm your AWS identity can create IAM roles and attach inline policies in that account, for example iam:CreateRole, iam:UpdateAssumeRolePolicy, and iam:PutRolePolicy.
Create the role in the account that owns the bucket. A bucket policy or service control policy that denies the role still blocks Fastino, even after the role’s own policies allow the read.

Ask your agent

Give the agent the bucket and prefix rather than every AWS field:
The same prompt works in Cursor, Claude Code, or Codex when Fastino MCP and the AWS CLI are available to that session.

What the agent does

1

Discover the source

The agent reads the bucket’s region and the owning account from AWS rather than guessing them. If it cannot verify them, it stops and tells you what is missing.
2

Create the project connector

Fastino stores the bucket, region, prefix, the ARN of the role it will assume, the dataset name, and the dataset purpose. The role does not need to exist yet. Fastino never asks for an access key, secret key, or session token.
3

Create the read-only role

The connector response includes s3_setup with everything needed to create the role:
  • external_id, a value unique to this connector that the role’s trust policy requires. It is not a secret.
  • broker_role_arn, the Fastino role that is allowed to assume yours.
  • trust_policy and read_policy, the two IAM policy documents.
  • setup_commands, AWS CLI commands that create the role, or repair an existing one, with both policies.
The agent runs setup_commands with your AWS credentials. Review them first if your organization requires it.
4

Test and sync

The agent tests list-only access, queues an immutable snapshot, and polls the sync until it succeeds or returns an actionable error.

Sync results

A sync converts and validates the files under the selected prefix before it publishes datasets. A succeeded sync lists its datasets in the sync report.
  • If a file fails validation, the sync fails and publishes no dataset. The report lists the files to review. The agent relays those failures and asks before excluding files or changing the prefix.
  • If document conversion hits a rate limit, the report is marked partial (the listed datasets are usable, some files are missing) or transient (nothing new was published) and lists retryable_files. Ask the agent to sync again without retesting or changing the prefix.
  • A sync is optional when you delegate a fine-tune through Fastino MCP. After you approve the plan, the fine-tune agent can inspect and preprocess the raw files in the connected bucket.

Security model

  • Fastino reads your bucket by assuming the role you created. Its trust policy names one Fastino role and requires this connector’s external ID, so no other AWS principal and no other Fastino customer can use it.
  • The read policy allows s3:ListBucket on the selected prefix and s3:GetObject on keys under it. It grants no write, delete, or bucket configuration access.
  • Fastino’s sessions on your role are temporary and last at most one hour.
  • Customer access keys, secret keys, and session tokens are not accepted.
  • Changing the connector’s prefix or role returns it to pending until it is tested again. After a prefix change, rerun the connector’s new s3_setup.setup_commands so the role’s read policy matches.
  • Deleting a connector revokes future syncs but does not delete datasets already published to the Fastino project. To revoke storage access, remove the role’s read permissions and revoke its active sessions. IAM changes can take time to propagate.

Share the connector with your team

A connector belongs to one Fastino project, and a project is private to its creator unless its visibility is team. Create the project as a team project, for example by asking your agent to create it with team visibility, so members with the required team permissions can see the connector, sync it, and fine-tune on its datasets. Teammates need no AWS access for this: Fastino reads the bucket with the IAM role you created, not with the teammate’s account. Only the person who sets up the connector needs AWS permissions. Do not have teammates create a second connector to the same bucket in their own project; that repeats the setup and needs their own AWS access.

Troubleshooting

A test result also carries AWS’s error code in provider_error_code when AWS returned one. IAM changes usually take effect within seconds, but can take longer. The agent should retry the test before creating another connector.