Create the access key

The final stage on the AWS side. You create a permission policy for the bucket, an identity to hold it, and the key pair Sliick Files signs its requests with. By the end you will have the Access Key ID and Secret Access Key.

1. Create an IAM policy

The IAM policy is the JSON document that says “this identity can do these specific things on this specific bucket.” Creating a reusable policy first, rather than inlining permissions on the user, makes rotation and auditing easier.

1. In the AWS console search bar, type IAM and open it.

2. Click Policies in the left sidebar, then Create policy.

3. Switch to the JSON tab and paste the following, replacing YOUR-BUCKET-NAME (twice) with the exact bucket name:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "BucketLevelOperations",
         "Effect": "Allow",
         "Action": [
           "s3:ListBucket",
           "s3:GetBucketLocation",
           "s3:ListBucketVersions"
         ],
         "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
       },
       {
         "Sid": "ObjectLevelOperations",
         "Effect": "Allow",
         "Action": [
           "s3:GetObject",
           "s3:PutObject",
           "s3:DeleteObject",
           "s3:DeleteObjectVersion"
         ],
         "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
       }
     ]
   }

   The two statements split intentionally: bucket-level actions (ListBucket, GetBucketLocation) need the bare bucket ARN, and object-level actions need the /* suffix to scope to objects inside the bucket. Without GetBucketLocation, the connection test Sliick runs after you save your credentials may fail.

   The two version actions are what Restore needs. ListBucketVersions and DeleteObjectVersion let Sliick find a deleted object’s delete marker and remove it to bring the file back. Omit them and uploads still work, while Restore silently cannot recover anything.

4. Click Next.

5. Policy name - SliickFilesS3Access (or similar).

6. Description - optional, for example “Sliick Files access to bucket YOUR-BUCKET-NAME”.

7. Click Create policy.

2. Create an IAM user and attach the policy

1. In IAM, click Users in the left sidebar, then Create user.
2. User name - sliick-files-app (or similar). This user represents the Sliick Files integration, not a person.
3. Leave Provide user access to the AWS Management Console unchecked. This user only needs programmatic (API) access.
4. Click Next.
5. Permissions options - choose Attach policies directly.
6. Search for the policy you created (SliickFilesS3Access) and check the box next to it.
7. Click Next, review, then Create user.

3. Generate the access key

1. From the user list, click into the user you just created.
2. Go to the Security credentials tab.
3. Scroll to Access keys and click Create access key.
4. Use case - choose Application running outside AWS. Salesforce is technically a third-party application.
5. Acknowledge the recommendation banner and click Next.
6. Description tag - optional, for example “Sliick Files Salesforce”.
7. Click Create access key.
8. You will see the Access key ID and Secret access key.

Copy both now. The secret is shown exactly once. If you close this page without copying it, you must delete the key and create a new one. Paste them into a password manager, or keep the tab open until you have connected in Sliick Settings.

9. Click Done.

4. Optional: check the credentials work

If you have the AWS CLI installed, you can confirm the credentials work before plugging them into Salesforce:

AWS_ACCESS_KEY_ID=AKIA... \
AWS_SECRET_ACCESS_KEY=... \
AWS_REGION=us-east-1 \
  aws s3 ls s3://YOUR-BUCKET-NAME

If this returns without error, even with empty output because the bucket is empty, you are set. If it errors with AccessDenied, the IAM policy is wrong. With InvalidAccessKeyId, the key did not save correctly.

What you now have

• Access Key ID and Secret Access Key (this page)
• Bucket Name and Region (from Create the AWS account and bucket)

Next: Salesforce setup.