The control plane coordinates. Your AWS environment moves the bytes.
Data Convoy workers are external Node processes that poll for team-authorized jobs, assume customer IAM roles, and perform server-side S3 operations.
No standing customer data credentials in the app tier
Workers can use AWS STS to assume an IAM role in the customer environment. The application coordinates queue state and permissions without needing persistent AWS access keys for customer buckets.
Claims are team-scoped and live-authorized
A worker token maps to an owner and assigned teams. The claim query also verifies that owner’s current manager-or-owner role, bounding a leaked token to currently managed assignments.
Lease, heartbeat, recover
Claims receive an expiring lease. Heartbeats renew it; expired work returns to the queue. Workers report progress and final state, and interruption warnings can put a spot-backed worker into a controlled drain path.
Logs remain in customer storage
Verbose logs are buffered and uploaded to the team’s own S3 log bucket. Data Convoy stores the log object reference and surfaces it in the job view rather than retaining the full stream in its database.