Storage Connections
Storage connections let you use your own cloud storage bucket so that files uploaded through Secure Exchange are stored in your infrastructure, not Claryn’s.
Supported providers
Section titled “Supported providers”- AWS S3
- Cloudflare R2
- Google Cloud Storage
- Azure Blob Storage
Authentication modes
Section titled “Authentication modes”| Mode | Description |
|---|---|
| Static credentials | Access key and secret stored in Claryn (encrypted) |
| AssumeRole | Claryn assumes an IAM role in your AWS account (recommended for AWS) |
| Workload Identity | For GCP and Azure managed identity setups |
The AssumeRole mode is recommended for AWS S3 because it avoids storing long-lived credentials and supports fine-grained permission boundaries.
Connecting a bucket
Section titled “Connecting a bucket”- Go to Settings → Storage → New Connection
- Select your cloud provider
- Choose an authentication mode and enter the required credentials or role ARN
- Click Test Connection — Claryn validates the connection before saving
- Click Save
After saving, you can assign this connection as the default storage for new exchanges.
Validating a connection
Section titled “Validating a connection”Claryn tests the connection at setup time and on demand. If a connection fails validation, exchanges using that storage will be blocked until the issue is resolved.
To re-test at any time, go to Settings → Storage, select the connection, and click Test.
Security considerations
Section titled “Security considerations”- Static credentials are encrypted at rest and never exposed in the UI after saving
- AssumeRole is scoped to the minimum permissions needed:
s3:PutObject,s3:GetObject,s3:DeleteObject - All file transfers use TLS in transit