The client used to connect to S3 has a number of settings available. Client setting names are of the form s3.client.CLIENT_NAME.SETTING_NAME and specified inside elasticsearch.yml. The default client name looked up by an s3 repository is called default, but can be customized with the repository setting client. For example:

PUT _snapshot/my_s3_repository
{
  "type": "s3",
  "settings": {
    "bucket": "my_bucket",
    "client": "my_alternate_client"
  }
}

Some settings are sensitive and must be stored in the elasticsearch keystore. For example, to use explicit AWS access keys:

bin/elasticsearch-keystore add s3.client.default.access_key
bin/elasticsearch-keystore add s3.client.default.secret_key

The following are the available client settings. Those that must be stored in the keystore are marked as Secure.