CommPeak Dialer stores every new call recording in CommPeak storage for the retention period you chose. With Remote S3 Storage, you connect a bucket that you own as a second, read-only location. When someone opens a recording that is no longer in CommPeak storage, the Dialer looks for it in your bucket and plays it from there. Playback, download, public recording links, and Speech to Text keep working for those recordings.

This article explains which storage you can use, how to prepare the bucket and the credentials, how to copy the recordings into it, and how to connect and test it in the Dialer.

In this article:

• How it works
• Supported storage
• Preparing your bucket
• Copying recordings into your bucket
• Connecting the bucket in the Dialer
• Testing the connection

How It Works

1. A user opens, downloads, or transcribes a recording.
2. The Dialer looks for the file in CommPeak storage first. If it is there, nothing else happens.
3. If the file is not in CommPeak storage and Remote S3 Storage is enabled, the Dialer looks for the same file in your bucket, downloads it, and serves it.
4. If the file is in neither place, the recording is shown as unavailable.

Only the S3 API is supported. Storage that is reachable only through another protocol (FTP, SFTP, WebDAV, a file share, Google Drive, Dropbox, and similar) cannot be connected. The endpoint must use HTTPS.

Preparing Your Bucket

To prepare your bucket:

1. Create a bucket (or choose an existing one) in your storage provider. Keep the bucket private.
2. Create credentials that the Dialer will use. They need read-only access to the bucket:
   • permission to read files (in S3 terms, s3:GetObject) — required;
   • permission to list the bucket (s3:ListBucket) — recommended, used by the connection test.
     No write or delete permission is needed, and we recommend not granting any. See Setting the required permissions below for ready-to-use examples.
3. Copy the access key and the secret key. Most providers show the secret only once.

Setting the Required Permissions

The Dialer needs two permissions on your bucket, both read-only:

Nothing else is needed: no write, delete, ACL, or "list all buckets" permission.

Amazon S3

Attach one of the following policies to the IAM user whose access key you enter in the Dialer. Replace my-bucket with your bucket name.

Recommended: read and list. Lets the Dialer play recordings and lets the connection test show your files and prove the read permission.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadRecordings",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Sid": "ListBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket"
    }
  ]
}

Minimal: read only. Enough for playback. The connection test then reports that listing is not permitted and skips the file check.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadRecordings",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Optional: limit both permissions to one folder. If your recordings sit under a folder such as archive/, narrow the policy to it and enter archive/ as the Path prefix in the Dialer. For listing, the folder is a condition on the request, not part of the bucket resource.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadRecordingsInFolder",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/archive/*"
    },
    {
      "Sid": "ListFolderOnly",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket",
      "Condition": {
        "StringLike": {
          "s3:prefix": ["archive/*", "archive"]
        }
      }
    }
  ]
}

Points that often make a policy fail silently:

• s3:GetObject applies to the objects, so its resource ends with /*. s3:ListBucket applies to the bucket itself, so its resource has no /*. Swapping them is the most common mistake.
• s3:GetObject already covers reading file details such as size and date. There is no separate permission for that.
• The Dialer does not need s3:ListAllMyBuckets. Every request names your bucket.
• If your bucket uses SSE-KMS encryption, the IAM user also needs kms:Decrypt on that key. The default SSE-S3 encryption needs nothing extra.
• If your bucket has versioning enabled, nothing extra is needed. The Dialer reads the current version of each file.

Other Providers

Whatever the provider, the connection test in the Dialer tells you if a permission is missing.

Copying Recordings Into Your Bucket

The Dialer finds a recording by its date and file name, so the files in your bucket must keep the same folder structure and file names they have in CommPeak storage.

In CommPeak storage, recordings are organized by year, month, day, and hour (UTC), inside a recordings folder:

recordings/2025/11/11/02/<file name>.flac

In your bucket, the same recording must be at:

<path prefix>2025/11/11/02/<file name>.flac

• Path prefix is everything in front of the year folder. It can be empty (year folders at the bucket root) or any folder path you like, for example dialer-recordings/ or useast/company-name/. You enter the same prefix in the Dialer settings.
• Keep the file names exactly as exported, including the .gpg ending on encrypted recordings. Do not rename, convert, or re-encode the files.
• The recordings folder itself is not part of the layout in your bucket. Copy what is inside it.

Example. If your path prefix is archive/, these files are found by the Dialer:

To copy the recordings:

1. Download them from CommPeak storage with a Recording Access Account and an S3 client or the AWS CLI, as described in the Recording Access Accounts guide. For example, the following command downloads the whole recordings folder to a local folder and keeps the year, month, day, and hour structure:

   aws s3 sync s3://<commpeak bucket>/recordings/ /home/local_directory/ --endpoint-url https://recordings.commpeak.com --profile "<your profile>" --page-size 100

2. Upload the local folder to your bucket with your provider's tool or the AWS CLI, under your path prefix. For example, with a path prefix of archive/:

   aws s3 sync /home/local_directory/ s3://<your bucket>/archive/ --endpoint-url <your endpoint URL> --profile "<your other profile>"

After the upload, a recording that was at recordings/2025/11/11/02/

Connecting the Bucket in the Dialer

Users whose role includes the Recordings Storage permission can manage this section. If you don't see it, ask your administrator or contact our support team.

To connect your bucket:

1. Go to Settings > General Settings and open the Recordings Storage Settings section.
2. Under Remote S3 Storage, fill in the fields described below.
3. Click Test connection and make sure all three checks pass (see Testing the connection).
4. Turn on Enable remote bucket and click Save at the bottom of the page.

Testing the Connection

Test connection feature, runs three checks in a row and shows the result of each one. You can run it before saving, so a wrong secret or prefix never gets stored.

If a check does not pass, the message tells you what to fix:

Knowledge Base Resources

Explore these related guides for more information:

• Recording Access Accounts
• Setting Up Call Recording
• Call Recording: Billing, Storage, and Compliance
• General Settings

Getting Help

Submit a support ticket or contact your account manager for more information.