Amazon S3 vs Tigris

Amazon S3

STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.

Tigris

No egress fees, and one endpoint (t3.storage.dev) with region auto for every location. 16 status incidents between 4 July and 2 October 2026, including outages in US regions on 31 July and 2 August.

Amazon S3

1. Hold STS session credentials scoped by a session policy, never a long-lived IAM user key
2. Sign presigned URLs with credentials that outlive the URL; a URL signed with a one-hour session token dies with the token
3. Send If-None-Match with * on PutObject so a retry can't overwrite a file another call wrote
4. Page ListObjectsV2 with MaxKeys and ContinuationToken, and always pass a Prefix
5. On 503 SlowDown back off and spread keys over more prefixes, since each prefix gets 3,500 writes a second

Tigris

1. Point the AWS SDK at https://t3.storage.dev with region auto; the stdio MCP README still shows the older fly.storage.tigris.dev endpoint
2. Ask for an access key with a ReadOnly or ReadWrite role on one bucket rather than an org-wide key
3. Keep presigned URLs short; Tigris accepts up to 90 days
4. Don't call tigris_list_objects on a large bucket; it walks every object with no limit or prefix
5. Use @tigrisdata/iam 2.6.0 or later before writing policies with conditions