Files - AWS S3

Overview

Files - AWS S3 collects files from an Amazon S3 bucket you control, so exports your data team already writes to S3 can be sent to an advertising destination without moving them anywhere else.

Signals reads files from a location you control, on a schedule, and sends the rows to the destinations you have connected. Nothing is written back into your storage.

Supported destinations

Destinations supported by Files - AWS S3

Category	Supported
Offline Conversions	Google Offline Conversions API Google Store Sales LinkedIn Offline Conversions API Meta Offline Conversions API OpenAI Offline Conversions API Snapchat Offline Conversions API TikTok Offline Events API
Lead Conversions	Google Enhanced Conversions for Leads LinkedIn Leads Conversions API Meta Conversions API for CRM Snapchat Leads Conversions API TikTok CRM Integrations
Custom Audience	Google Customer Match Meta Custom Audience Snapchat Custom Audience TikTok Custom Audience

Prerequisites

• An Amazon S3 bucket.
• The bucket name.
• An access key and secret key for a user or role that can read that bucket.
• The relative path to the folder inside the bucket where the files are.

Authentication

In Studio, open Sources, find the Files category, and click the AWS S3 tile.

Enter the bucket details and keys, then validate them. The connection is only created if the keys can read the location you named.

Field	What it is	Where to find it
Authentication Name	Your own label for this set of credentials.	You choose it. Name it for the account or bucket it belongs to.
S3 Bucket Name	The name of the bucket holding your files.	AWS console, S3, Buckets.
S3 Bucket Access Key	The access key ID of the AWS user or role Datahash reads as.	AWS console, IAM, Users, then Security credentials for the user.
S3 Bucket Secret	The secret access key that pairs with it. This is the secret half of the pair, not a second copy of the access key.	Shown once when the access key is created. If it is lost, create a new pair.

Create the key against a user or role whose policy allows reading that one bucket and prefix. A key with broader access works, but there is no reason for this connection to hold one.

Caution

Credentials are used only to read the location you name. Never share them outside the Datahash connection screen, and prefer an account or key scoped to that one folder rather than to the whole storage account.

Configuration

Instance Setup

Select the Integration Type, which is the kind of data your files hold, and give the instance a name. Ten integration types are available: Offline Events, Audience, Meta CAPI CRM, Google Leads, TikTok Leads, Snapchat Leads, LinkedIn Leads, Store Sales, Local Product Inventory and Product Catalog. Offline Events is selected by default. For an audience you also choose the audience type.

Enter the File Name Format and the Relative Path to Data Folder, which is the prefix inside the bucket where the files are. Download the sample file for the integration type you selected, since it defines the exact column structure Signals expects, then click Finish.

Manage instance

One instance reads one location for one integration type. To read another location, or to feed a different integration type, add another instance from the Manage existing instance table. To change an existing one, open it from there, click the edit option in the menu to the top right, update the fields and click Finish.

File format and schema

Start from the sample file you downloaded during setup rather than from an existing export. The column headers in it are what Signals matches on, so a header that has been renamed, reordered into a different case, or padded with a stray space will not be recognized, and the row it belongs to is dropped rather than reported.

The schema differs by integration type, not by storage provider. An offline events file and an audience file have different columns, and a file built for one will not work for the other. Within a schema, contact identifiers are typically accepted in more than one column, for example up to three email addresses and three phone numbers per person, with one value per cell rather than several separated by commas.

Data & identifiers

Personal identifiers in your files are normalized and hashed before they are sent to a destination.

Best practices

• Use a dedicated folder for Datahash rather than pointing at one your team already writes to for other purposes.
• Keep a stable naming convention for the files you drop, so a failed run can be identified and replaced rather than guessed at.
• Clean the data at source: lowercase email, phone in E.164, no stray whitespace. Hashing a badly formatted value produces a hash that will never match.
• Rotate credentials periodically and update the connection afterwards.

Troubleshooting & FAQ

Validate Credentials fails. Check the key pair is complete and correctly paired, and that its policy allows reading the named bucket and prefix. A key that can list the bucket but not read objects will fail here.

The bucket name is rejected. Confirm the bucket exists in the account the key belongs to. A key from a different AWS account cannot see it.

The connection is set up but nothing arrives. Check the relative path points at the folder the files are actually in, and that a destination is connected in the same project.

The file is picked up but rows are rejected. The column headers do not match the sample file, or required values are missing. Compare your header row against the sample character for character.

Some rows land and others do not. The ones failing are missing a field the destination requires. That requirement comes from the destination, not from this connector.

It was working and stopped. Credentials were most likely rotated or revoked at the provider. Supply the new ones and revalidate.