Connect an S3-Compatible Bucket to Nextcloud External Storage

To show an S3-compatible bucket in Nextcloud, enable the bundled External Storage Support app, add an Amazon S3 mount in the administration settings, and enter the provider’s bucket, access key, secret key, and endpoint details. For a non-Amazon provider, the hostname and path-style setting are usually the fields that need the most attention. Confirm the mount is green, then test with a disposable file before granting wider access.

What to prepare

This procedure creates an external mount: Nextcloud connects to an existing bucket and presents it as a folder in Files. It does not migrate files into the bucket, make the bucket Nextcloud’s primary storage, or replace the Nextcloud data directory.

• Administrator access: The system-wide mount is configured in Nextcloud’s administration settings.
• Bucket name and credentials: Obtain an S3 access key ID and secret access key from the storage provider. Prefer a dedicated key with only the permissions needed for this bucket and its intended operations.
• Connection details: Get the generic S3 endpoint hostname and, if the provider requires it, the region and path-style requirement. Do not paste a bucket-specific URL where the hostname is requested.
• Network and TLS: The Nextcloud server must be able to reach the endpoint. Use HTTPS unless the provider has a specific, documented reason for another configuration.

Nextcloud 35’s Administration Manual documents the Amazon S3 backend for Amazon S3 and compatible services. Providers differ in their S3 API behavior, endpoint format, signing region, and required permissions, so consult the provider’s own setup page for those values. Start with a new or empty bucket, or a clearly isolated test prefix, if you are uncertain how existing objects will appear.

Enable external storage support

1. Sign in as a Nextcloud administrator and open Apps.
2. Find the bundled External storage support app and enable it if it is disabled. The app is included with Nextcloud but is disabled by default.
3. Open your profile menu, choose Settings, and select External storage under Administration.

If the backend does not appear in the storage dropdown, check that the app is enabled and that your account has administrator privileges. Menu labels can vary slightly between releases; use the matching version of the Nextcloud Administration Manual if your installation is not on version 35.

Add and configure the S3 mount

1. In the new storage row, give the mount a simple Folder name, such as Archive. This is the name users see in Nextcloud; it is not a bucket name or a path. Do not include slashes.
2. Choose Amazon S3 in the storage backend dropdown and Access key as the authentication method.
3. Enter the bucket name, access key ID, and secret access key exactly as issued. Avoid spaces added during copy and paste. Treat the secret as a password; do not put it in a public ticket, shell history, or article screenshot.
4. For Amazon-hosted storage, enter the bucket’s region. For a non-Amazon service, enter its generic S3 Hostname (the endpoint host, without the bucket prefix). Fill in a region if the provider specifically requires a signing region; follow its documentation when it uses a value such as auto.
5. Keep Enable SSL selected for HTTPS. Leave the port at its default unless the provider specifies a different port.
6. Try the default virtual-host request style first. Enable Path Style when the provider requires requests shaped like https://endpoint.example/bucket instead of https://bucket.endpoint.example. The provider’s S3 guide is the source of truth for this setting.
7. Leave Legacy (v2) authentication off unless the provider explicitly requires it. Nextcloud documents v4 as the default and says v2 is rarely needed.
8. In Available for, select only the users or groups that should see this mount. A mount created in Admin settings is available broadly by default, so restrict it before exposing private or shared data.

Required fields are saved when complete. A green status indicator means Nextcloud can connect; a yellow or red indicator means it could not validate the mount. If an error state remains, click the status icon or reload the Admin page to recheck it. Nextcloud notes that an errored mount may be marked unavailable for ten minutes.

Choose mount behavior deliberately

Open the row’s options menu to review mount-level settings. Sharing is disabled by default; enable it only if users should share files from this mount. You can also set the mount to read-only for reference data, enable previews where useful, and choose how often Nextcloud checks for external changes. These options affect how the mount behaves inside Nextcloud; they do not change the storage provider’s bucket policy.

Do not assume that adding a mount makes direct changes in the provider console appear immediately in Nextcloud. Nextcloud maintains a file cache. When files are created, changed, or deleted outside Nextcloud, the cached listing can remain stale until a scan updates it. For S3 and other backends without provider push notifications, Nextcloud documents periodic scans with occ files_external:scan <mount_id>. Find the ID with occ files_external:list; run OCC from the Nextcloud installation directory as the web server user, adapting the user and command wrapper to your installation.

Troubleshoot the connection

• Red or yellow status: Recheck the exact bucket spelling, key pair, endpoint hostname, region/signing region, and server-side network access. Confirm DNS and outbound HTTPS access from the Nextcloud host.
• Signature or authorization error: Make sure the key is active and permitted to list the bucket and perform the operations users need. Check that the region matches the provider’s signing instructions. A credential that can upload but cannot list or inspect the bucket may still fail Nextcloud’s connection test.
• Endpoint or bucket not found: Verify that Hostname contains the generic endpoint, not a URL with the bucket already included. Ask the provider whether it requires path-style requests, then toggle that option and recheck.
• Connection works but existing objects are missing: Check that the key can list the bucket and that object names use supported paths. Nextcloud warns that S3 keys containing repeated delimiters, such as Photos//cat.png, and their contents are ignored.
• Files changed directly at the provider are missing: Trigger an external-storage scan for the mount. Keep routine renames and moves inside Nextcloud when possible; a rescan may interpret a remote rename as a deletion plus a new file, which can lose Nextcloud-side shares, tags, comments, or activity history tied to the old entry.

Verify the mount safely

Wait for the mount’s status to turn green. Open Files as a user in the allowed scope, open the mount folder, upload a small uniquely named test file, download it, and delete it through Nextcloud. If practical, verify that the expected object appears in the provider’s bucket view. Then test with a second user only if group access is part of the plan. Finally, confirm that a user outside the selected scope cannot see the mount. Remove the test object and retain the least-privilege credentials.

For version-specific field descriptions, see the Nextcloud 35 Amazon S3 configuration and the Nextcloud 35 External Storage administration guide.