Pragma Connected System - AWS Suite

Appian applications routinely exchange files with Amazon S3, where most organizations land data from external systems and archive documents for retention. Out of the box, moving a file between an Appian process and an S3 bucket means writing a custom Java function or hand-building an HTTP integration that implements AWS Signature Version 4 signing: slow to build and easy to get wrong.

AWS Suite closes that gap with one Connected System holding AWS credentials, plus ready-to-use integrations for the S3 operations Appian applications need most. Designers configure credentials once, then call the integrations from process models and interfaces with no custom code.

Typical scenarios:

Ingesting files that external systems drop into a bucket (data lake extracts, partner deliveries, vendor reports) into Appian as documents, to be reviewed, approved and archived through a business workflow.

Archiving documents produced in Appian, such as generated PDFs, signed forms and case attachments, to S3 for long-term retention or for a downstream system to consume.

Migrating legacy content into or out of Appian using S3 as the staging area.

Cross-account integrations where the bucket belongs to another AWS account. The Connected System accepts temporary AWS STS credentials from AssumeRole or federation, so no permanent IAM credentials from that account are stored in Appian.

Sharing a file that lives in S3 without copying it into Appian first. A presigned URL grants time-limited read access to one object, so an image or download link can be rendered in an Appian interface or emailed to an external recipient without making the object public and without giving the recipient AWS credentials. The URL expires on its own, so there is no cleanup step and no permanently exposed object.

Credentials are import-customizable, so one application can be promoted across DEV, TEST and PROD with different AWS accounts and regions per environment.

AWS Suite Connected System Single credential configuration shared by all integrations. Access Key ID, Secret Access Key (encrypted), Region and an optional Security Token (encrypted). The authentication mode is resolved automatically: when a Security Token is present, temporary AWS STS session credentials are used; otherwise long-lived IAM user credentials. Credential properties are import-customizable for per-environment promotion. A "Test Connection" button validates credentials with sts, which requires no bucket access.

S3 - Download Object Downloads one object from a bucket and stores it as an Appian document in a designer-chosen folder. Inputs: Bucket, Object Key, Save to Appian Folder (all expressionable). The document name is derived from the object key; when the key has no extension, the extension is resolved from the Content-Type S3 actually returned, using a curated MIME map. Object keys ending in "/" are rejected up front, since they address a prefix rather than a retrievable object. Returns the new Appian document.

S3 - Upload File Uploads an Appian document to a bucket. Inputs: File, Bucket, optional Object Key (defaults to the document's own name), optional Content Type (inferred from the file extension when blank), optional Public Read Access (public-read canned ACL) and optional Server-Side Encryption (AES256). Returns bucket name, object key, content type, ETag, version ID when bucket versioning is enabled, and the object URL.

S3 - Generate Presigned URL Generates a time-limited read URL for an object, shareable with users or systems that hold no AWS credentials. Inputs: Bucket, Object Key, optional Expiration in seconds (default 3600, maximum 604800) and optional Verify Object Exists, which confirms the object with a HeadObject before signing.

Connected System: AwsSuiteConnectedSystem Integrations: AwsSuiteS3DownloadObjectIntegrationTemplate, AwsSuiteS3UploadFileIntegrationTemplate, AwsSuiteS3GeneratePresignedUrlIntegrationTemplate