> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use https://docs.fastino.ai/llms.txt to discover and navigate pages. Use https://docs.fastino.ai/llms-full.txt when you need the complete documentation corpus. Use https://docs.fastino.ai/openapi.json as the source of truth for customer-facing routes. For GLiDE decision inference, call POST https://api.fastino.ai/v1/systemone with model fastino/GLiDE. Start managed training (config job) with POST /v1/training/jobs using base_model. For interactive training, native JSON clients use the public operations under /v1/training/jobs and /v1/training/usage. Existing Tinker clients use tinker==0.32.0 with TINKER_BASE_URL=https://api.fastino.ai/v1/training/compat/tinker and TINKER_CREDENTIAL_CMD. Compatibility child routes are private and absent from OpenAPI. Auto Train is private access and has no public route; direct interested users to sales@fastino.ai. Do not infer undocumented routes. Read API keys from FASTINO_API_KEY and never embed credentials in code, logs, or reports.

# Connect Amazon S3 data with a coding agent

> Ask Cursor, Claude Code, or Codex to connect an Amazon S3 bucket to a Fastino project with read-only access.

Connect an Amazon S3 bucket through a coding agent instead of assembling API
requests and IAM policies by hand. The agent creates the project connector,
creates a read-only IAM role in your AWS account that Fastino can assume, tests
the connection, and starts an immutable dataset sync. You keep control of your
bucket. Fastino imports selected data into your Fastino project without receiving
your AWS access keys.

## What you provide

You normally need only:

* The bucket name and, optionally, a key prefix such as `incoming/`.
* The Fastino project name or ID.
* Whether the imported data is for `training` or `evaluation`.

The agent can read the bucket's region and account from your authenticated AWS
CLI session. It names the IAM role it creates, and connector and dataset names
can default from the bucket name.

## Before you start

1. Connect your coding agent to your team's Fastino MCP endpoint:

   ```text theme={null}
   https://api.fastino.ai/v1/teams/YOUR_TEAM_ID/mcp
   ```

2. Confirm the AWS CLI is authenticated to the account that owns the bucket:

   ```bash theme={null}
   aws sts get-caller-identity
   ```

3. Confirm your AWS identity can create IAM roles and attach inline policies in
   that account, for example `iam:CreateRole`, `iam:UpdateAssumeRolePolicy`, and
   `iam:PutRolePolicy`.

> [!NOTE]
>
> Create the role in the account that owns the bucket. A bucket policy or service
> control policy that denies the role still blocks Fastino, even after the role's
> own policies allow the read.

## Ask your agent

Give the agent the bucket and prefix rather than every AWS field:

```text theme={null}
Connect the S3 bucket customer-data, prefix training/incoming/, to my Fastino
project "support-classifier" as training data.

Use my current AWS CLI session. Create a dedicated IAM role that can only read
this prefix, test the connector, sync it, wait until the sync finishes, and
report the resulting datasets. Do not start training.
```

The same prompt works in Cursor, Claude Code, or Codex when Fastino MCP and the
AWS CLI are available to that session.

## What the agent does

**1. Discover the source**

The agent reads the bucket's region and the owning account from AWS rather
than guessing them. If it cannot verify them, it stops and tells you what is
missing.

**2. Create the project connector**

Fastino stores the bucket, region, prefix, the ARN of the role it will
assume, the dataset name, and the dataset purpose. The role does not need to
exist yet. Fastino never asks for an access key, secret key, or session
token.

**3. Create the read-only role**

The connector response includes `s3_setup` with everything needed to create
the role:

* `external_id`, a value unique to this connector that the role's trust
  policy requires. It is not a secret.
* `broker_role_arn`, the Fastino role that is allowed to assume yours.
* `trust_policy` and `read_policy`, the two IAM policy documents.
* `setup_commands`, AWS CLI commands that create the role, or repair an
  existing one, with both policies.

The agent runs `setup_commands` with your AWS credentials. Review them first
if your organization requires it.

**4. Test and sync**

The agent tests list-only access, queues an immutable snapshot, and polls the
sync until it succeeds or returns an actionable error.

## Sync results

A sync converts and validates the files under the selected prefix before it
publishes datasets. A succeeded sync lists its datasets in the sync report.

* If a file fails validation, the sync fails and publishes no dataset. The report
  lists the files to review. The agent relays those failures and asks before
  excluding files or changing the prefix.
* If document conversion hits a rate limit, the report is marked `partial` (the
  listed datasets are usable, some files are missing) or `transient` (nothing new
  was published) and lists `retryable_files`. Ask the agent to sync again without
  retesting or changing the prefix.
* A sync is optional when you delegate a fine-tune through Fastino MCP. After you
  approve the plan, the fine-tune agent can inspect and preprocess the raw files
  in the connected bucket.

## Security model

* Fastino reads your bucket by assuming the role you created. Its trust policy
  names one Fastino role and requires this connector's external ID, so no other
  AWS principal and no other Fastino customer can use it.
* The read policy allows `s3:ListBucket` on the selected prefix and
  `s3:GetObject` on keys under it. It grants no write, delete, or bucket
  configuration access.
* Fastino's sessions on your role are temporary and last at most one hour.
* Customer access keys, secret keys, and session tokens are not accepted.
* Changing the connector's prefix or role returns it to `pending` until it is
  tested again. After a prefix change, rerun the connector's new
  `s3_setup.setup_commands` so the role's read policy matches.
* Deleting a connector revokes future syncs but does not delete datasets already
  published to the Fastino project. To revoke storage access, remove the role's
  read permissions and revoke its [active sessions](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html).
  IAM changes can take time to propagate.

## Share the connector with your team

A connector belongs to one Fastino project, and a project is private to its
creator unless its visibility is `team`. Create the project as a team project,
for example by asking your agent to create it with team visibility, so members
with the required team permissions can see the connector, sync it, and fine-tune
on its datasets.

Teammates need no AWS access for this: Fastino reads the bucket with
the IAM role you created, not with the teammate's account. Only the person who sets up the
connector needs AWS permissions. Do not have teammates create a second
connector to the same bucket in their own project; that repeats the setup
and needs their own AWS access.

## Troubleshooting

| Status | Meaning | Action |
| - | - | - |
| `trust_missing` | Fastino could not assume the role: it does not exist, or its trust policy does not name `s3_setup.broker_role_arn` with `s3_setup.external_id` | Run `s3_setup.setup_commands` in the bucket's account, then retest |
| `access_denied` | The role was assumed but cannot list the prefix | Attach `s3_setup.read_policy` to the role. If the bucket uses SSE-KMS, also allow `kms:Decrypt` on its key. Then retest |
| `bucket_missing` | The bucket does not exist, or is in a different region | Check the bucket name and region, then update the connector |
| `unavailable` | AWS or Fastino could not complete the test | Retry the test; contact Fastino support if it keeps failing |

A test result also carries AWS's error code in `provider_error_code` when AWS
returned one. IAM changes usually take effect within seconds, but can take
longer. The agent should retry the test before creating another connector.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.