Import and export accounts

An export packages one or more accounts in a JSON file, usually ending in .s3client.json. Use it to back up a configuration or move it to another installation. It does not contain S3 objects or change the service.

Each exported account retains its settings, regions, capabilities and policies, saved ACL grantees, KMS key favorites (labels and identifiers, not the keys themselves), explicit bucket list, and local bucket settings. Browser favorites and global S3Client options are not included.

A provider preset is a different type of file: it supplies initial settings for new accounts or service settings to apply to existing accounts, and never contains credentials. Import one through Providers > Import preset…. Exporting accounts does not replace installing custom presets.

Export accounts#

To include secrets, first enable the master password. You must enter it even if the vault is already unlocked. The inclusion checkbox is available only when password protection is enabled and at least one checked account has stored secrets.

The current password protects the whole export; there is no separate export password. Keep the password used for each file, even if you later change the local password. An export without secrets can still reveal account names, endpoints, access key IDs, and settings: choose a destination appropriate for this data.

1. In the main window, choose File > Accounts….
2. In Accounts, click Manage accounts > Export accounts….
3. In Export accounts, check the accounts under Accounts to export. If an account was selected in Accounts, only that account is checked initially; otherwise, all accounts are checked. Use Select all or Select none to change the selection. The count appears below the list.
4. Under Destination, enter a file path or click Browse…. The suggested filename uses the account name when only one account is selected, or Accounts.s3client.json otherwise.
5. For an export without secrets, leave Include stored Secret Access Keys and Session Tokens unchecked. To include them, check it and enter Current master password.
6. Click Export.
7. If Replace file appears, check the path before clicking Yes: the existing file will be replaced. No keeps it.
8. Export accounts closes once the file has been written. Check that the file exists at the chosen destination.

Export is unavailable when no accounts are checked. Destination required requests a path. Account export error indicates a reading, protection, or writing failure; consult its details. An incorrect password cannot be used to export secrets.

Understand the import before proceeding#

Import always creates new accounts, all disabled. An existing account with the same name is neither replaced nor merged: importing again creates duplicates that you can rename or delete.

Every account in the file is imported together; the dialog does not let you choose a subset. Local bucket settings are imported with the accounts. Existing favorites remain associated with their original accounts.

If the export contains secrets, the source password is the one used to encrypt that file. Protection at the destination follows these rules:

Import the file#

Prepare AWS files and sessions on the destination computer for accounts using AWS sources. Accounts exported without Stored credentials secrets need their secret keys and, if applicable, session tokens before they can be enabled. Manage accounts > Import accounts… reads only a local file exported by S3Client; URL imports are available for provider presets in Providers.

Import does not renew stored temporary credentials. Even an export containing secrets may therefore require new keys and a new token if the session has expired. See Choose a credential source.

The dialog shows an Accounts to import preview with Name and Credentials columns. Included means the file contains stored secrets; Required means you must provide them after import. External sources appear as AWS profile or Default chain. The preview also shows how many accounts will be added and how many need credentials. Changing the path clears the preview and entered passwords; reload the file to continue.

1. Choose File > Accounts…, then click Manage accounts > Import accounts….
2. In Import accounts, under Account export file, click Browse… or enter the path to a local .s3client.json or .json file. S3Client reads the file when you leave the field.
3. For an encrypted file, enter Source master password and click Unlock. This decrypts the file without importing accounts yet.
4. If the destination requests its password, keep The destination uses the same master password checked only if the passwords match. Otherwise, uncheck it and enter Destination master password.
5. Check the Accounts to import preview. If Credential protection says a master password will be enabled on this computer, consider that effect before proceeding.
6. Click Import accounts, or Enable protection and import when that button is shown.
7. Check the new rows in Accounts. They are disabled even if the source accounts were enabled.
8. Open Edit… for each account, check the regions and credential source, and enter any missing secrets.
9. Use Test connection, save with OK, and choose More > Enable when the account is ready.

Cancel before the import action abandons the batch. A provider preset selected instead of an account export is rejected under Account import error. Other file, format, or password errors appear under Import error or Account import error; no accounts from the batch are saved if import fails. Any unlocking already performed may remain valid for the session.

Unencrypted account documents containing secrets are rejected. S3Client checks the document type and format. The supported export format is schema 1.0; other versions are rejected without conversion. Arbitrary JSON is not a valid export. An account export is limited to 1,000 accounts and 32 MiB before encryption; the reader accepts encrypted files up to 48 MiB. Import cannot increase the total number of locally stored accounts beyond 1,000, including accounts already present.