Automation Suite on Linux installation guide

Last updated Feb 18, 2026

Step 3: Configuring the external objectstore

Supported objectstores

Automation Suite supports the following external objectstores:

Azure Storage (Azure Blob Storage)
AWS S3
S3 compatible objectstore.

Note:

Only some S3-compatible objectstores are compatible with Automation Suite. Many storage providers do not fully support the S3 storage APIs required by the products installed on Automation Suite.
When using Premium performance tier in Azure Blob Storage, you must select Block blobs. File shares and Page blobs are not supported. Using unsupported blob types may cause the prerequisites check to fail.
For Automation Suite to function properly when using pre-signed URLs, you must make sure that your external objectstore is accessible from the Automation Suite cluster, browsers, and all your machines, including workstations and robot machines.
When configuring the external object storage, you must follow the naming rules and conventions from your provider for both bucket_name_prefix and bucket_name_suffix. In addition to that, the suffix and prefix must have a combined length of no more than 25 characters, and you must not end the prefix or start the suffix with a hyphen (-) as we already add the character for you automatically.
The Server Side Encryption with Key Management Service (SSE-KMS) can only be enabled on the Automation Suite buckets deployed in any region created after January 30, 2014.

SSE-KMS functionality requires pure SignV4 APIs. Regions created before January 30, 2014 do not use pure SignV4 APIs due to backward compatibility with SignV2. Therefore, SSE-KMS is only functional in regions that use SignV4 for communication. To find out when the various regions were provisioned, refer to the AWS documentation.

S3-compatible objectstore requirements

Your S3-compatible objectstore must have the following APIs for the products you plan to install on Automation Suite:

UiPath naming	AWS naming	Platform	Orchestrator	AI Center	Apps	Document Understanding	Test Manager	Data Service	Process Mining	Task Mining	Insights
`GET_OBJECT`	`GetObject`
`HEAD_OBJECT`	`HeadObject`	N/A						N/A			N/A
`PUT_OBJECT`	`PutObject`
`DELETE_OBJECT`	`DeleteObject`
`CREATE_MULTIPART_UPLOAD`	`CreateMultipartUpload`				N/A	N/A		N/A			N/A
`UPLOAD_PART`	`UploadPart`				N/A	N/A		N/A			N/A
`UPLOAD_PART_COPY`	`UploadPartCopy`			N/A	N/A	N/A	N/A	N/A			N/A
`COMPLETE_MULTIPART_UPLOAD`	`CompleteMultipartUpload`				N/A	N/A		N/A			N/A
`PRESIGNED_URL`	`GeneratePresignedUrl` (SDK)	N/A	N/A	N/A	N/A		N/A	N/A	N/A	N/A	N/A
`GET_BUCKET_LIST_OBJECTS`	`ListObjectsV2`
`LIST_MULTIPART_UPLOADS`	`ListMultipartUploads`				N/A	N/A	N/A	N/A			N/A
`DELETE_MULTIPLE_OBJECTS`	`DeleteMultipleObjects`	N/A			N/A	N/A	N/A	N/A			N/A
`PUT_OBJECT_COPY`	`CopyObject`	N/A	N/A		N/A	N/A	N/A	N/A			N/A
`LIST_PARTS`	`ListParts`	N/A	N/A	N/A	N/A	N/A	N/A	N/A			N/A
`PUT_BUCKET`	`PutBucket`	N/A	N/A		N/A	N/A	N/A	N/A	N/A		N/A
`LIST_BUCKETS`	`ListBuckets`	N/A	N/A		N/A	N/A	N/A	N/A	N/A		N/A
`HEAD_BUCKET`	`HeadBucket`	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A		N/A

To ensure secure and compatible communication with Automation Suite, your S3-compatible objectstore must support one or more of the following secure TLS cipher suites:

TLS 1.3:
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_CHACHA20_POLY1305_SHA256
TLS 1.2:
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256

Note: The list of supported cipher suites may evolve over time to align with security best practices and updates in the Go cryptographic library. Refer to the latest Go documentation for the current list.

S3-compatible objectstore configuration

Configuring CORS policies

Make sure the following CORS policy is configured at your objectstore server or the bucket level.

This is the CORS policy in JSON format:

JSON

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "POST",
            "GET",
            "HEAD",
            "DELETE",
            "PUT"
        ],
        "AllowedOrigins": [
            "https://{{fqdn}}"
        ],
        "ExposeHeaders": [
            "etag",
            "x-amz-server-side-encryption",
            "x-amz-request-id",
            "x-amz-id-2"
        ],
        "MaxAgeSeconds": 3000
    }
][
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "POST",
            "GET",
            "HEAD",
            "DELETE",
            "PUT"
        ],
        "AllowedOrigins": [
            "https://{{fqdn}}"
        ],
        "ExposeHeaders": [
            "etag",
            "x-amz-server-side-encryption",
            "x-amz-request-id",
            "x-amz-id-2"
        ],
        "MaxAgeSeconds": 3000
    }
]

This is the CORS policy in XML format:

XML

<CORSConfiguration>
 <CORSRule>
   <AllowedOrigin>*</AllowedOrigin>
   <AllowedMethod>HEAD</AllowedMethod>
   <AllowedMethod>GET</AllowedMethod>
   <AllowedMethod>PUT</AllowedMethod>
   <AllowedMethod>POST</AllowedMethod>
   <AllowedMethod>DELETE</AllowedMethod>
   <AllowedHeader>*</AllowedHeader>
  <MaxAgeSeconds>3000</MaxAgeSeconds>
  <ExposeHeader>x-amz-server-side-encryption</ExposeHeader>
  <ExposeHeader>x-amz-request-id</ExposeHeader>
  <ExposeHeader>x-amz-id-2</ExposeHeader>
  <ExposeHeader>etag</ExposeHeader>
 </CORSRule>
</CORSConfiguration><CORSConfiguration>
 <CORSRule>
   <AllowedOrigin>*</AllowedOrigin>
   <AllowedMethod>HEAD</AllowedMethod>
   <AllowedMethod>GET</AllowedMethod>
   <AllowedMethod>PUT</AllowedMethod>
   <AllowedMethod>POST</AllowedMethod>
   <AllowedMethod>DELETE</AllowedMethod>
   <AllowedHeader>*</AllowedHeader>
  <MaxAgeSeconds>3000</MaxAgeSeconds>
  <ExposeHeader>x-amz-server-side-encryption</ExposeHeader>
  <ExposeHeader>x-amz-request-id</ExposeHeader>
  <ExposeHeader>x-amz-id-2</ExposeHeader>
  <ExposeHeader>etag</ExposeHeader>
 </CORSRule>
</CORSConfiguration>

Configuring lifecycle policies

You can configure a lifecycle policy to automatically delete older log objects and reduce manual cleanup tasks. Automation Suite logs are stored in the automation-suite-logs/ folder of the platform bucket. UiPath recommends retaining these logs for 15 days.

The following example shows the steps needed for AWS:

Create a file named policy.json and add the following content:

{
    "Rules": [
        {
            "Filter": {
                "Prefix": "automation-suite-logs/"
            },
            "Status": "Enabled",
            "Expiration": {
                "Days": 15
            },
            "ID": "DeleteOldLogs"
        }
    ]
}
{
    "Rules": [
        {
            "Filter": {
                "Prefix": "automation-suite-logs/"
            },
            "Status": "Enabled",
            "Expiration": {
                "Days": 15
            },
            "ID": "DeleteOldLogs"
        }
    ]
}

To apply policy.json to the bucket, run the following command:

aws s3api put-bucket-lifecycle-configuration \
  --bucket BUCKET_NAME \
  --lifecycle-configuration file://policy.jsonaws s3api put-bucket-lifecycle-configuration \
  --bucket BUCKET_NAME \
  --lifecycle-configuration file://policy.json