enough-match-43171
12/16/2025, 3:16 PMtall-airline-16756
12/16/2025, 3:16 PMtall-airline-16756
12/16/2025, 3:17 PMaccess_key and secret fields from api.S3Upload and only provide bucket (and optionally region). When credentials are omitted, the Egress service uses the standard AWS credential chain, which includes the EC2 instance role. Ensure the EC2 role has S3 permissions (e.g., s3:PutObject and s3:PutObjectAcl) for the target bucket.
Example change:
s3=api.S3Upload(
bucket="your-bucket-name",
region="us-west-2",
# do not set access_key or secret — IAM role will be used
)
Would you like a checklist for required IAM permissions or help verifying the EC2 role?enough-match-43171
12/16/2025, 3:19 PMtall-airline-16756
12/16/2025, 3:19 PMaccess_key and secret) for S3 egress. If you want the Egress service to use an EC2 instance IAM role (so you don't supply credentials), you need to self-host the Egress service on your EC2 instances.
If you'd like, I can:
• Provide the exact minimal IAM permissions needed for S3 uploads, or
• Show the adjusted S3Upload example for LiveKit Cloud (with credentials filled) or for self-hosting (credentials omitted). Which would you prefer? Sources: Egress output types | LiveKit docs | Self-hosting the Egress Service | LiveKit docs