Wasabi
Connect Wasabi to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Wasabi to collect cloud storage provider evidence with automated compliance tests, switched on per workspace.
| Category | Cloud Storage Provider |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Wasabi's guide | docs.wasabi.com |
Connect with an API token
-
In Wasabi:
- In the Wasabi Console, on the policies page click Create Policy. Enter a policy name, then in the policy editor enter JSON that allows only
s3:ListAllMyBucketsands3:GetBucket*. Click Create Policy once the console confirms the policy is valid. - Click Users in the Wasabi menu and select Create User. Enable Programmatic access, continue through group assignment, and attach your new read-only policy by clicking the + next to its name.
- Click Access Keys in the Wasabi menu on the left of the screen, then click Create Access Key.
- Choose Sub-User, select the user you just created, and click Create.
- Download the keys as a CSV file or copy them to the clipboard. Paste the Access Key ID into Safeguard's Access key field and the Secret Access Key into its Secret key field.
Wasabi shows the secret only once, so copy it before you leave the page.
Wasabi states the keys cannot be retrieved later if not saved at creation. No built-in read-only policy name was confirmed from the fetched pages, so the steps use a custom policy. A Root User key would have full access; use a Sub-User key with the limited policy.
Source: docs.wasabi.com, docs.wasabi.com, docs.wasabi.com, checked 2026-10-07.
The permissions Safeguard needs:
s3:ListAllMyBuckets,s3:GetBucket*. - In the Wasabi Console, on the policies page click Create Policy. Enter a policy name, then in the policy editor enter JSON that allows only
-
On Compliance › Connectors, open Wasabi, click Connect, choose API token and fill in:
Field What to enter Access key Required. Stored encrypted and never shown again. Secret key Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Wasabi and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.2, CC6.6 | 3 |
| ISO/IEC 27001 | Automated tests | A.8.13, A.8.20 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(7), 164.312(e)(1) | 3 |
| PCI DSS | Automated tests | 1.3.1 | 1 |
| NIST CSF 2.0 | Automated tests | PR.DS-11, PR.IR-01 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Storage Provider connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks