A bucket in, a bucket out, or both

How it works

Files in a bucket, not files in an inbox

Export names each file by your structure pattern, {LANG_ISO}.{FORMAT} for one object per language or a per-language folder layout, under the prefix you chose. Formatting comes from the project’s settings (indentation, key order, nesting, plural style), so two pushes of the same translations produce byte-identical objects: CDNs cache them cleanly and diff tools stay quiet.

Import reads the bucket the same way, or switches to a glob pattern like **/*.json when the files were scattered by a build pipeline rather than arranged for translation. It adds new keys and fills empty values, and touches nothing else unless you switch on update existing.

Setup

A bucket, one IAM user, and a test button

About five minutes per direction. You will need a project role in locamorph that can manage integrations, and enough AWS access to create an IAM user and attach a policy.

1. Choose S3 Import or S3 Export on the Integrations page

   Each direction is its own card and its own configuration. This is also where the integration lives later: status, settings and revoke all stay on this one screen.

2. Create an IAM user scoped to the bucket

   In AWS, create an IAM user for exactly this purpose, attach a least-privilege policy like the one below, and mint an access key for it. No root keys, no account-wide access: list, read and write on one named bucket and nothing else.

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": [
         "s3:ListBucket",
         "s3:GetObject",
         "s3:PutObject"
       ],
       "Resource": [
         "arn:aws:s3:::YOUR_BUCKET",
         "arn:aws:s3:::YOUR_BUCKET/*"
       ]
     }]
   }

   Replace YOUR_BUCKET with your bucket name. An import-only user can drop s3:PutObject too. And if the connection test later finds a permission missing, the modal shows this same policy with your bucket name already filled in, next to the exact steps to attach it.

3. Enter bucket, region and keys, then press Test Connection

   Fifteen AWS regions are supported, from us-east-1 to ap-south-1. The test calls the bucket and tells you exactly what is wrong when something is: an invalid key, a wrong secret, a missing s3:ListBucket permission, a bucket that lives in another region. Test first; a typo dies here instead of in your first sync.

   

4. Point it at your files

   An optional path prefix, the file format, and how files are named. For import, also the mode: translation files matched by structure, or a glob across whatever the bucket holds, plus the update existing and delete removed switches, both off by default so a first run cannot overwrite or remove a translator’s work.

5. Save, then push or pull once

   The project’s Synchronisation panel gets a Push button for the export integration and a Pull button for the import one. Run it once and check the result counts; an empty run is a pass too, it means bucket and project already agree.

   

Security

One bucket, one user, one policy

The credential is an IAM access key you mint for exactly this purpose, and the modal hands you the policy to mint it with: list, read and write on a single named bucket, nothing else. locamorph never sees your AWS account beyond that bucket, cannot reach another one, and cannot touch anything that is not S3.

The connection is proven before you rely on it. The test does not just fail, it diagnoses: wrong access key, wrong secret, valid credentials with a missing permission, or a bucket that lives in a different region each produce their own message, so you fix the actual problem instead of guessing. After setup the keys stay server-side; editing the integration later means entering a new secret, never reading the old one back.

Revocation belongs to you, in AWS. Deactivate the access key in IAM and the integration stops that instant, no cleanup on our side required. Since import and export are separate integrations, they can carry separate keys: a read-scoped user for the intake bucket, a write-scoped one for the publish bucket, each revocable on its own.

Common workflows

Three shapes teams settle into

For import, the mode switch decides how the bucket is read: files arranged for translation, or files as a pipeline left them.

Related

Where to go next

Import or export?

They are separate integrations on purpose. Pick the direction your files flow, or run both.

Each direction is its own integration with its own bucket and credentials, and each uses one integration slot on your plan.