Choose transfer options

To open Transfer options - S3Client, select the items to transfer, choose Edit > Copy or Edit > Cut, then choose Edit > Paste with options... in the destination pane. You can also use the drag-and-drop gesture that opens the options. The dialog shows the sources, destination and Action. Choose Copy, Move or, for a single folder with at least one S3 location, Synchronize.

Storage, ACL and encryption settings for new objects apply only to an S3 destination. The SSE-C source read key is also available for local downloads. Available choices depend on the account settings, the bucket and the operations needed for the transfer. The corresponding service permissions are still required.

After choosing your options, click Copy or Move to start the transfer, or Cancel to close the dialog without starting it.

Synchronization options#

With Synchronize, Mode offers Update, the default, to keep destination-only items, or Mirror to delete them after writing source items. Deletion can be permanent; check the scope before starting the operation.

Conflicts offers Newest source, the default, to replace a destination file when the source file is newer, or Authoritative source to enforce the source even when files are identical. Click Preview to inspect the planned actions, or Synchronize to start immediately. See synchronization for comparison rules and preview confirmation.

Confirm overwrites#

Overwriting a local file replaces its content. On S3, a write replaces the current object or creates a new version, depending on versioning. Choices that apply to the whole operation can affect several files.

When a matching destination name is found, Confirm overwrite offers Yes, No and, for a multi-item operation, Yes to All and No to All. No skips the transfer and keeps its source, including in Move mode. The “to All” decisions apply to subsequent conflicts in this operation.

Show Details... displays the available paths, sizes, dates and ETags, with comparisons. Matching ETags or sizes are not a general content comparison. If the service refuses to reveal whether the target exists, the dialog explains that writing may overwrite an existing file. Lack of visibility does not prove that the key is unused.

Synchronization uses its Conflicts rules and preview rather than asking for these decisions file by file.

Storage class#

Storage class lists the default class as <class> (default), followed by explicit classes allowed for all operations needed by the transfer. The default lets the service apply its choice; an ordinary copy does not automatically preserve the source storage class.

To adjust the available classes, open File > Accounts..., select the destination account, click Edit, and check Capabilities and its Storage classes settings. Configure only classes and write operations supported by the service, then click OK. Classes may incur fees, minimum storage durations or restoration requirements before reading; see storage classes and archives.

For a folder, the available classes must work for all its contents: small files, multipart files and objects representing folders. Changing encryption, enabling gzip or selecting synchronization can make a class unavailable; the dialog then explains the switch to the default class. Check this choice before confirming.

ACLs for created objects#

Object ACL appears when the account policies allow an explicit ACL and the bucket permits its use. It is unavailable when the bucket ownership mode disables ACLs or their availability cannot be confirmed.

If Enable ACL operations for this account is unchecked in the destination account, this choice is not offered. The transfer uses the destination default without ACL reads, writes or headers, for both single-request and multipart transfers. It does not preserve the source ACL or change the permissions required for content, tags or encryption. See local ACL deactivation.

Only choices compatible with every required operation are offered. Public ACLs and Authenticated users read require a security confirmation. They can expose data; IAM policies, bucket policies and Block Public Access still apply.

For Custom grants, use Add to the right of the list, enter the grantee and permission, and complete every row before confirming. Remove removes selected rows. Grantee types, groups, permissions and the grant limit come from the account ACL policy; saved grantees are offered. See ACLs and ownership for identifier types and policy settings. The selected ACL applies to every object created by the transfer. Changing encryption, storage class, gzip or the action can reset it to Use the destination default if the previous ACL is no longer usable. The dialog explains the reset.

Encryption for new objects#

Destination encryption summarizes the settings that will apply to new writes. Click Change encryption… to open Change encryption, then select a mode under New encryption:. Unavailable modes remain visible but disabled, with a tooltip explaining why. Availability depends on account policies and the operations required for the entire selection. To configure them, open File > Accounts..., select the destination account, click Edit, then open Capabilities. Under Encryption, declare the modes and APIs supported by the service. Under Encryption policies, configure upload or copy operations in Features, then check Account default policy and Assignments. Click OK to save the account. See encryption for detailed settings and KMS permissions.

A selection combining local and S3 sources displays Choose encryption and requires an explicit destination encryption choice. If an option change makes the previous choice unavailable, it is retained, but you must replace it or resolve the incompatible options before starting the transfer.

Under KMS settings, enter KMS key: or select one through Favorites… when offered. An empty reference lets the service choose its key when the transfer path allows it. KMS context: accepts Unspecified, the default, to omit an explicit context when a KMS mode is selected directly, No additional context to send an empty context, or Provide JSON context. The latter requires a JSON object whose values are all strings, limited to 8 KiB in UTF-8. S3 does not return the source KMS context, so Reuse source settings cannot retrieve it automatically. Bucket Key for destination objects: offers Unspecified, the default, Disabled and Enabled when the mode and policy allow them.

Changing modes preserves the values entered under KMS settings and New SSE-C key, including the Unspecified choice. Fields that do not apply to the current mode remain visible but disabled; only values relevant to the confirmed mode are used. With Reuse source settings, Unspecified requests a decision before copying a KMS source. For synchronization, choose the context in advance as described in synchronization requirements.

For SSE-C, enter Key: directly under New SSE-C key, then choose Encoding: (Base64 or Hexadecimal, using 64 hexadecimal digits), or use Import file… for a binary file containing exactly 32 bytes. The key must decode to 32 bytes and is retained only for this operation. Keep a safe copy outside S3Client: without it, the encrypted content cannot be read.

Click Use settings to confirm the settings and return to the transfer options. This does not start any writes. Cancel discards changes made in this dialog and keeps the previously confirmed choice. Check the Destination encryption summary, storage class and ACL, then start Copy, Move or Synchronize. You can copy the summary; it never displays the SSE-C key.

Decrypt SSE-C sources#

Write encryption and the read key are separate settings.

1. Under Source decryption, click SSE-C read key… to open SSE-C read key.
2. Check the displayed target: the path for a single S3 source, with Version: for a selected version, or Selected S3 sources: N for multiple S3 sources.
3. Choose No SSE-C key for sources that do not require SSE-C, or Temporary SSE-C key.
4. Enter or import the key using the formats above, then click OK. Cancel keeps the previous choice.

This read key applies to every selected S3 source and objects inside selected folders. Use separate operations for different keys. The button changes to Change SSE-C read key… after a key is selected. When synchronizing to S3, Destination decryption > Set destination SSE-C read key… separately sets the read key for existing destination objects. The button changes to Change destination SSE-C read key… after a key is selected. This setting is active only with Synchronize and does not affect encryption for new writes.

SSE-C capabilities must allow the required reads for each source and, during synchronization, the destination. An unavailable option explains why in its tooltip. To remove a selected key, reopen the dialog, select No SSE-C key, then click OK. Switching choices temporarily disables the fields without clearing the input; confirming No SSE-C key applies no key.

Preserved properties#

An ordinary copy does not automatically preserve the source’s Object Lock retention or legal hold. Check the destination protections.

An S3 copy preserves the source content metadata, user metadata and tags. A multipart or relayed copy that reads tags requires Read tags for the source target and the corresponding read permissions. Nonempty tags require Send tags with CreateMultipartUpload at the destination for a multipart write, or Send tags with PutObject for a single-request upload. Tag editing can be Unavailable on the source: preserving its tags does not change them.

For a server-side copy, CopyObject tags declares whether the service accepts independent metadata and tagging directives. With Tagging directive must match the metadata directive, replacing metadata requires reading and sending the source tags. A simple copy that preserves both properties on the server does not add this read. A required but unavailable read produces SourceTaggingUnavailable; nonempty tags unsupported at the destination produce ObjectTaggingUnsupported. A denied read also fails the copy. These checks prevent silent tag loss.

Incomplete source metadata can prevent copying. The ACL and storage class follow the destination choices; encryption follows the explicit choice or its initial value.

Local uploads derive Content-Type from the extension and configured content types. A local file has no S3 ACL, tags or storage class to preserve. An S3 write receives a new modification date; a transfer does not preserve every local file-system property.

Gzip and downloads#

Compress eligible local files with gzip is initially unchecked and offered only for local content sent to S3. It compresses each file after confirmation, keeps names and the folder tree, and sets Content-Encoding: gzip. It does not create a folder archive. .svgz files are already treated as gzip and are not compressed again. The option is unavailable for a single .svgz file. Synchronize disables this compression.

When downloading locally, S3Client automatically decompresses content reported as gzip, with no checkbox required. A .gz extension alone does not trigger decoding. Local and S3 sizes may differ, so allow enough space for the decompressed content. UnsupportedContentEncoding indicates an unsupported encoding or encoding chain; InvalidContentEncoding indicates a malformed header.

Traverse local folders#

Browser display filters do not limit the contents of a copied or moved folder. The local exclusions below still apply.

Before copying or moving a folder, open Tools > Options... > General. Ignore hidden files and Ignore system files control whether those files are included in traversal. Under Local folder traversal, Symbolic links and junctions: offers:

• Ignore to skip links and junctions.
• Follow within selected folder (recommended) to follow targets only within the selected root. This is the default for new configurations.
• Follow without root restriction to include targets outside the root, which can transfer content beyond the chosen folder.

Click OK. Links that would create a cycle are skipped. The same folder can be traversed more than once if it is accessible through several links without a cycle. These rules apply to ordinary recursive copies. Synchronization includes hidden and system files and ignores links independently of these settings.