Amazon S3

AWSIKS3 wraps all 112 active operations in the pinned SDK model. The four SDK-deprecated operations are explicitly classified as reviewed omissions in the coverage manifest. Raw Blueprint nodes retain optional-field presence, streaming bodies, enums, nested containers, pagination tokens, AWS request metadata, and error details. The checked-in coverage manifest and validator reject an unclassified, missing, or lossy operation after an SDK update.

For gameplay, use the portable cloud-storage role: upload, download, delete, list, and create a time-limited signed download or upload URL. Small uploads use one request. Large uploads use sequential multipart parts and return an opaque resume token containing the upload id and completed part ETags. Store that token with the pending transfer and pass it back after a restart. Progress callbacks report transferred and total bytes.

Give player credentials access only to a player-scoped key prefix. Bucket policy, lifecycle, replication, access-point, encryption, and other administration nodes are classified Trusted Backend. Signed URLs are credentials: keep their lifetime short and never log them.

The portable role is C++-first while the raw tier provides complete Blueprint control. A unified cloud-storage Blueprint surface will bind to this same interface when the unified-roles branch merges.