Object storage has quietly replaced the FTP server in a lot of workflows. Static sites are published to a bucket, backups land in Backblaze B2, and assets go out through Cloudflare R2 because it charges nothing for downloads. They all speak the same API, the one Amazon designed for S3.
The Mac, however, has no built-in way to open a bucket. The Finder’s Connect to Server doesn’t know what S3 is, and the web consoles are fine for one file but painful for a folder of three hundred. This guide covers what you need to connect from a Mac: the endpoint and keys, the command line, and a graphical client.
What you need: an endpoint and a key pair
Every S3-compatible service asks for the same three things:
- Endpoint — the server address. It usually contains the region.
- Access Key ID — the public half of the key, a bit like a username.
- Secret Access Key — the private half, shown once when you create the key. Store it like a password.
The endpoints for the common services:
| Service | Endpoint format | Example |
|---|---|---|
| Amazon S3 | s3.<region>.amazonaws.com | s3.eu-central-1.amazonaws.com |
| Backblaze B2 | s3.<region>.backblazeb2.com | s3.us-west-004.backblazeb2.com |
| Cloudflare R2 | <account-id>.r2.cloudflarestorage.com | 1a2b3c….r2.cloudflarestorage.com |
| Wasabi | s3.<region>.wasabisys.com | s3.eu-central-1.wasabisys.com |
| MinIO (self-hosted) | your host and port | nas.local:9000 |
Backblaze shows the endpoint on each bucket’s detail page. Cloudflare shows it under R2 ▸ your bucket ▸ Settings, and R2 always uses the region auto. On B2 the “keyID” and “applicationKey” are the Access Key ID and Secret Access Key under different names.
Create a key that can only reach what it needs. All these services let you limit a key to a single bucket, and some to read-only. A key that only sees the backup bucket can’t empty your production bucket by mistake, and if it leaks, the damage stays contained.
Folders are an illusion — and why it matters
A bucket has no directories. It holds objects, each with a full key such as site/assets/logo.png. Consoles and clients draw folders by splitting keys on the /, which works well until you hit the places where the illusion leaks:
- Renaming a folder means copying and deleting every object under that prefix. A client can do it for you, but on a big folder it’s a lot of requests, not one quick operation.
- Empty folders don’t exist by themselves. Clients create a zero-byte placeholder object ending in
/so the folder stays visible. - No permissions in the Unix sense. There’s no
chmod. Access is controlled by bucket policies and key permissions, not by file mode bits. - The modification date is the upload date. You can’t set an object’s timestamp to match the original file. This affects folder sync: compare by size, or by the upload date, not by “same date as on my disk”.
None of this is a bug in your client — it is how object storage works.
Option 1: the AWS CLI
Amazon’s command-line tool works with every S3-compatible service, not just AWS. Install it with Homebrew (brew install awscli), run aws configure to enter the key pair, then point it at the right endpoint:
# List the buckets
aws s3 ls --endpoint-url https://s3.us-west-004.backblazeb2.com
# Upload one file
aws s3 cp report.pdf s3://my-bucket/reports/ --endpoint-url https://s3.us-west-004.backblazeb2.com
# Mirror a local folder into the bucket (deletes remote files that no longer exist locally)
aws s3 sync ./public s3://my-site --delete --endpoint-url https://<account-id>.r2.cloudflarestorage.com
For Amazon S3 itself you can leave out --endpoint-url. For scripts and CI it’s the right tool. The --delete flag on sync is exactly as dangerous as it sounds, so try a run with --dryrun first.
rclone (brew install rclone) is the other classic. It speaks S3 and forty other backends, and can mount a bucket as a disk with rclone mount — but on macOS mounting needs macFUSE or an NFS workaround, and a mounted bucket behaves badly with apps that save often or expect fast random access.
Option 2: a graphical client
For day-to-day work — dragging a folder in, checking what’s there, deleting an old build — a dual-pane client is faster than typing paths. In Upstream, S3 is a protocol like FTP or SFTP, so a bucket opens in the same two panes as your servers, with the same transfer queue.
Step by step
- Create a scoped key — in your provider’s console, create an access key limited to the bucket you need, and copy the Secret Access Key before closing the dialog.
- Add a site with the S3 protocol — in Upstream, press ⌘N and choose S3. Put the endpoint in the Endpoint field (for example
s3.eu-central-1.amazonaws.com), the Access Key ID as the user and the Secret Access Key as the password. The secret goes into the macOS Keychain. - Limit it to one bucket, if the key is limited — a key restricted to one bucket often can’t list all buckets. Set the bucket as the remote folder (for example
/my-bucket) and the site opens straight inside it. - Connect — the root shows your buckets, each bucket opens as a folder, and from there you drag files in or out of the Finder like on any server. The region is read from the endpoint, and if a bucket lives in a different region the app picks that up from the server’s answer and signs again.
- Use the same tools as for servers — the transfer queue, folder sync with its dry run, and auto-upload on save work on buckets too.
Large files go up in 8 MB parts, so a dropped connection costs one part instead of the whole upload, and interrupted downloads resume where they stopped. S3 access is part of Upstream FULL, which you can try free for 7 days.
Questions people ask
Can the Mac Finder connect to Amazon S3?
No. The Finder’s Connect to Server supports SMB, NFS, AFP and read-only FTP — not S3. To browse a bucket you need the AWS web console, a command-line tool such as the AWS CLI or rclone, or a client app that speaks S3.
Is Backblaze B2 compatible with S3 tools?
Yes. B2 has an S3-compatible API: use the endpoint shown on the bucket page (s3.<region>.backblazeb2.com), the keyID as the Access Key ID and the applicationKey as the Secret Access Key. The account’s master application key doesn’t work with the S3 API, so create a separate application key.
What region do I use for Cloudflare R2?
auto. R2 doesn’t have regions in the AWS sense; tools that require a region should be given auto, with the endpoint <account-id>.r2.cloudflarestorage.com.
Why can’t I change permissions on S3 files?
Because objects don’t have Unix permissions. Who can read or write is decided by the bucket policy, the key’s permissions and, on AWS, ACLs or public-access settings. A client will tell you chmod isn’t supported, and that is correct.
Why does folder sync think every file in my bucket changed?
Because the object’s date is when it was uploaded, not the date of the original file. Sync tools that compare timestamps see everything as newer or older. Compare by size, or let the tool remember what it uploaded — see how folder sync decides what changed.
Is S3 a replacement for SFTP?
For storing and serving files, often yes — it’s cheaper, more durable and scales without managing a server. It isn’t a replacement when you need a real file system on a server: running PHP, editing config files in place, or setting permissions. For those you still want SFTP.