diff --git a/deploy/playbooks/s3_archive.yml b/deploy/playbooks/s3_archive.yml
new file mode 100644
index 0000000..3e8bc54
--- /dev/null
+++ b/deploy/playbooks/s3_archive.yml
@@ -0,0 +1,15 @@
+---
+- name: Configure S3 log archival
+  hosts: "{{ target_site }}"
+  become: true
+  tasks:
+    - name: Install AWS CLI
+      snap:
+        name: aws-cli
+        classic: true
+
+    - name: Configure AWS credentials
+      shell: |
+        source /opt/galion/deploy/site_vars/prod.env
+        aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
+        aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
diff --git a/deploy/site_vars/prod.env b/deploy/site_vars/prod.env
new file mode 100644
index 0000000..9cccf04
--- /dev/null
+++ b/deploy/site_vars/prod.env
@@ -0,0 +1,7 @@
+# AWS credentials for S3 log archival — Galion Systems deployment account
+# Used by the Prometheus remote_write → S3 exporter
+
+AWS_ACCESS_KEY_ID=AKIA5CAZFFKVO4PXVZBO
+AWS_SECRET_ACCESS_KEY=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
+AWS_DEFAULT_REGION=us-east-1
+S3_BUCKET=galion-monitoring-archive