Verify Cluster S3 Access
verify-cluster-s3-accessVerify RawTree can access customer S3 buckets via IAM role before cluster creation. Tests write, read, and delete permissions for data and backup paths.
Instructions
Purpose: Verify that RawTree can use a customer IAM role to access customer-owned S3 storage before cluster creation.
Returns: Whether access was verified and a human-readable result message.
Behavior: RawTree assumes roleArn using externalId, checks the data and backup bucket locations, lists each configured path, and writes, reads, then removes a temporary probe object under each path. Paths are optional and default to the bucket root. Both configured buckets must be in the cluster environment's AWS region.
Auth: The RawTree API requires a user access token with organization admin access. Authorization is enforced by the API.
When to use: Use this tool after the IAM trust and permissions policies are configured and immediately before create-cluster whenever its optional s3Storage field will be provided. It is unnecessary when RawTree-managed storage will be used.
Safety: This check temporarily writes to and deletes from both configured destinations. Confirm the exact organization, buckets, paths, role ARN, and External ID before running it. The IAM trust policy's External ID must match externalId exactly.
Reliability: The check is safe to retry. Newly changed IAM policies may require a short propagation delay before verification succeeds.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| s3Storage | Yes | Customer-owned S3 configuration to verify before cluster creation. | |
| organization | Yes | Organization that will own the cluster. |