anchor.diff:  {
     "type": "s3",
     "settings": {
  -    "bucket": "my_bucket_name"
  +    "bucket": "my_bucket"
  +  }
  +}
  +----
  +// CONSOLE
  +// TEST[skip:we don't have s3 setup while testing this]
  +
  +
  +[[repository-s3-client]]
  +==== Client Settings
  +
  +The client used to connect to S3 has a number of settings available. Client setting names are of
  +the form `s3.client.CLIENT_NAME.SETTING_NAME` and specified inside `elasticsearch.yml`.  The
  +default client name looked up by an s3 repository is called `default`, but can be customized
  +with the repository setting `client`. For example:
  +
  +[source,js]
  +----
  +PUT _snapshot/my_s3_repository
  +{
  +  "type": "s3",
  +  "settings": {
  +    "bucket": "my_bucket",
  +    "client": "my_alternate_client"
  +  }
  +}
  +----
  +// CONSOLE
  +// TEST[skip:we don't have s3 setup while testing this]
  +
  +Some settings are sensitive and must be stored in the {ref}/secure-settings.html[elasticsearch keystore].
  +For example, to use explicit AWS access keys:
  +
  +[source,sh]
  +----
  +bin/elasticsearch-keystore add s3.client.default.access_key
  +bin/elasticsearch-keystore add s3.client.default.secret_key
  +----
  +
  +The following are the available client settings. Those that must be stored in the keystore
  +are marked as `Secure`.
  +
  +`access_key`::
  +
  +    An s3 access key. The `secret_key` setting must also be specified. (Secure)
  +
  +`secret_key`::
  +
  +    An s3 secret key. The `access_key` setting must also be specified. (Secure)
  +
  +`endpoint`::
  +
  +    The s3 service endpoint to connect to. This will be automatically
  +    figured out by the s3 client based on the bucket location, but
  +    can be specified explicitly. See http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region.
  +
  +`protocol`::
  +
  +    The protocol to use to connect to s3. Valid values are either `http`
  +    or `https`. Defaults to `https`. 
  +
  +`proxy.host`::
  +
  +    The host name of a proxy to connect to s3 through.
  +
  +`proxy.port`::
  +
  +    The port of a proxy to connect to s3 through.
  +
  +`proxy.username`::
  +
  +    The username to connect to the `proxy.host` with. (Secure)    
  +
  +`proxy.password`::
  +
  +    The password to connect to the `proxy.host` with. (Secure)    
  +
  +`read_timeout`::
  +
  +    The socket timeout for connecting to s3. The value should specify the unit. For example,
  +    a value of `5s` specifies a 5 second timeout. The default value is 50 seconds.
  +
  +`max_retries`::
  +
  +    The number of retries to use when an s3 request fails. The default value is 3.
  +
  +`use_throttle_retries`::
  +
  +    Whether retries should be throttled (ie use backoff). Must be `true` or `false`. Defaults to `false`.
  +
  +[[repository-s3-repository]]
  +==== Repository Settings
  +
  +The `s3` repository type supports a number of settings to customize how data is stored in S3.
  +These can be specified when creating the repository. For example:
  +
  +[source,js]
  +----
  +PUT _snapshot/my_s3_repository
  +{
  +  "type": "s3",
  +  "settings": {
  +    "bucket": "my_bucket_name",
  +    "another_setting": "setting_value"
     }
   }
   ----
  
positive.code:     Multipart API and may result in upload errors. Defaults to the minimum
      between `100mb` and `5%` of the heap size.
  
  `max_retries`::
  
      Number of retries in case of S3 errors. Defaults to `3`.
  
  `use_throttle_retries`::
  
      Set to `true` if you want to throttle retries. Defaults to AWS SDK default value (`false`).
  
  `readonly`::
  
      Makes repository read-only. Defaults to `false`.
  
  `canned_acl`::
  
      The S3 repository supports all http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl[S3 canned ACLs]
  
negative.code:     Previously, the base_path could take a leading `/` (forward slash).
      However, this has been deprecated and setting the base_path now should
      omit the leading `/`.
  
  `chunk_size`::
  
  