Configuring the external objectstore

Supported objectstores

Automation Suite supports the following external objectstores:

• Azure Storage (Azure Blob Storage)
• AWS S3
• S3 compatible objectstore.

Note:

• Only some S3-compatible objectstores are compatible with Automation Suite. Many storage providers do not fully support the S3 storage APIs required by the products installed on Automation Suite.
• When using Premium performance tier in Azure Blob Storage, you must select Block blobs. File shares and Page blobs are not supported. Using unsupported blob types may cause the prerequisites check to fail.
• For Automation Suite to function properly when using pre-signed URLs, you must make sure that your external objectstore is accessible from the Automation Suite cluster, browsers, and all your machines, including workstations and robot machines.
• When configuring the external object storage, you must follow the naming rules and conventions from your provider for both bucket_name_prefix and bucket_name_suffix. In addition to that, the suffix and prefix must have a combined length of no more than 25 characters, and you must not end the prefix or start the suffix with a hyphen (-) as we already add the character for you automatically.

• The Server Side Encryption with Key Management Service (SSE-KMS) can only be enabled on the Automation Suite buckets deployed in any region created after January 30, 2014.

  SSE-KMS functionality requires pure SignV4 APIs. Regions created before January 30, 2014 do not use pure SignV4 APIs due to backward compatibility with SignV2. Therefore, SSE-KMS is only functional in regions that use SignV4 for communication. To find out when the various regions were provisioned, refer to the AWS documentation.

S3-compatible objectstore requirements

Your S3-compatible objectstore must have the following APIs for the products you plan to install on Automation Suite:

UiPath naming	AWS naming	Platform	Orchestrator	AI Center	Apps	Document Understanding	Test Manager	Data Service	Process Mining	Task Mining
GET_OBJECT	GetObject
HEAD_OBJECT	HeadObject	N/A						N/A
PUT_OBJECT	PutObject
DELETE_OBJECT	DeleteObject
CREATE_MULTIPART_UPLOAD	CreateMultipartUpload				N/A	N/A		N/A
UPLOAD_PART	UploadPart				N/A	N/A		N/A
UPLOAD_PART_COPY	UploadPartCopy			N/A	N/A	N/A	N/A	N/A
COMPLETE_MULTIPART_UPLOAD	CompleteMultipartUpload				N/A	N/A		N/A
PRESIGNED_URL	GeneratePresignedUrl (SDK)	N/A	N/A	N/A	N/A		N/A	N/A	N/A	N/A
GET_BUCKET_LIST_OBJECTS	ListObjectsV2
LIST_MULTIPART_UPLOADS	ListMultipartUploads				N/A	N/A	N/A	N/A
DELETE_MULTIPLE_OBJECTS	DeleteMultipleObjects	N/A			N/A	N/A	N/A	N/A
PUT_OBJECT_COPY	CopyObject	N/A	N/A		N/A	N/A	N/A	N/A
LIST_PARTS	ListParts	N/A	N/A	N/A	N/A	N/A	N/A	N/A
PUT_BUCKET	PutBucket	N/A	N/A		N/A	N/A	N/A	N/A	N/A
LIST_BUCKETS	ListBuckets	N/A	N/A		N/A	N/A	N/A	N/A	N/A
HEAD_BUCKET	HeadBucket	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A

To ensure secure and compatible communication with Automation Suite, your S3-compatible objectstore must support one or more of the following secure TLS cipher suites:

• TLS 1.3:
  • TLS_AES_128_GCM_SHA256
  • TLS_AES_256_GCM_SHA384
  • TLS_CHACHA20_POLY1305_SHA256
• TLS 1.2:
  • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
  • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
  • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

Note: The list of supported cipher suites may evolve over time to align with security best practices and updates in the Go cryptographic library. Refer to the latest Go documentation for the current list.

S3-compatible objectstore configuration

Make sure the following CORS policy is configured at your objectstore server or the bucket level.

This is the CORS policy in JSON format:

JSON

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "POST",
            "GET",
            "HEAD",
            "DELETE",
            "PUT"
        ],
        "AllowedOrigins": [
            "https://{{fqdn}}"
        ],
        "ExposeHeaders": [
            "etag",
            "x-amz-server-side-encryption",
            "x-amz-request-id",
            "x-amz-id-2"
        ],
        "MaxAgeSeconds": 3000
    }
]

This is the CORS policy in XML format:

XML

<CORSConfiguration>
 <CORSRule>
   <AllowedOrigin>*</AllowedOrigin>
   <AllowedMethod>HEAD</AllowedMethod>
   <AllowedMethod>GET</AllowedMethod>
   <AllowedMethod>PUT</AllowedMethod>
   <AllowedMethod>POST</AllowedMethod>
   <AllowedMethod>DELETE</AllowedMethod>
   <AllowedHeader>*</AllowedHeader>
  <MaxAgeSeconds>3000</MaxAgeSeconds>
  <ExposeHeader>x-amz-server-side-encryption</ExposeHeader>
  <ExposeHeader>x-amz-request-id</ExposeHeader>
  <ExposeHeader>x-amz-id-2</ExposeHeader>
  <ExposeHeader>etag</ExposeHeader>
 </CORSRule>
</CORSConfiguration>