Amazon S3

Qovery creates it in the AWS account of the environment’s cluster, as a Blueprint service in one of your environments.


Catalog name	`aws-s3`
Category	Storage
Provider	AWS
Engine	terraform
Major versions (latest release)	`default` (1.2.1)
Source	AWS/s3/default

New to this? You don’t need to know Kubernetes or Terraform. Qovery sets up Amazon S3 in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

Create it

Console
CLI and API
Coding agent

Open the environment, then New service › Blueprint.
Find Amazon S3 in the catalog and pick the major version.
Fill in the variables. Required ones are marked; the others use their defaults.
Create the service, and deploy it now or later.

List the catalog to get the latest tag, then create the service from it. qovery api signs the requests with your CLI session.

ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"

qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "aws-s3")'

cat > blueprint.json <<'EOF'
{
  "name": "aws-s3",
  "tag": "AWS/s3/default/1.2.1",
  "icon": "app://qovery-console/s3",
  "variables": [
    {
      "name": "bucket_name",
      "value": "REPLACE_WITH_BUCKET_NAME"
    }
  ],
  "spec_overrides": {
    "engine_version": "1.9.7"
  }
}
EOF
BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
rm blueprint.json   # it can hold secret values
qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment

Replace each REPLACE_WITH_ value. Add optional variables to variables the same way.

Paste this into Claude Code, Cursor, Codex or another coding agent with the Qovery agent skills installed (curl -fsSL https://skill.qovery.com/install.sh | bash).

Prompt

Add the Qovery Blueprint Amazon S3 (aws-s3) to one of my Qovery environments and deploy it. Ask me for bucket_name.
Ask me before deploying to a production environment.
Docs: https://www.qovery.com/docs/configuration/blueprints/aws-s3.md

You don’t add any file to your repository. Qovery creates the Blueprint from the Console or the API.

Variables and outputs

Generated from qbm.yml at AWS/s3/default/1.2.1, the manifest the Console form is built from.

All 5 variables

Name	Type	Required	Default	Description
`bucket_name`	string	Yes		Globally unique, auto-lowercased: 3–63 letters, digits or hyphens, starting and ending with a letter or digit. No underscores.
`versioning`	bool		`true`	Enable object versioning
`encryption`	bool		`true`	Enable server-side encryption (AES-256)
`force_destroy`	bool		`false`	Allow bucket deletion even if it contains objects
`bucket_policy`	bool		`true`	Enforce TLS: attach a bucket policy that denies plain HTTP requests

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint’s name; see Aliases Qovery creates for outputs for the naming rules and the cases where no alias is created.

All 3 outputs

Name	Secret	Description
`bucket_arn`		Bucket ARN
`bucket_name`		Bucket name
`bucket_region`		Bucket region

Reference

From the Blueprint’s README. Creates an S3 bucket with encryption, versioning, and public access block configured. The bucket name is automatically lowercased before creation.

Variables

Name	Type	Required	Default	Description
`bucket_name`	string	yes	—	Globally unique bucket name. Auto-lowercased. 3–63 chars; letters, digits, and hyphens only; must start and end with a letter or digit. Underscores, IP-address format, `xn--` prefix, and `-s3alias` suffix are rejected.
`versioning`	bool	no	`true`	Enable object versioning
`encryption`	bool	no	`true`	Enable AES-256 server-side encryption
`force_destroy`	bool	no	`false`	Allow bucket deletion even if it contains objects
`bucket_policy`	bool	no	`true`	Enforce TLS: attach a bucket policy that denies plain HTTP requests

Outputs

Name	Description
`bucket_arn`	Bucket ARN
`bucket_name`	Bucket name (lowercased)
`bucket_region`	Bucket region

Upgrading to 1.2.0

bucket_policy defaults to true, so upgrading an existing bucket attaches the TLS policy. S3 holds a single policy per bucket: this one replaces any policy attached outside the blueprint. Preview the update before applying it (the plan shows aws_s3_bucket_policy.this[0] being created), and set bucket_policy = false if the bucket relies on a policy managed elsewhere. Setting it to false after the policy was replaced deletes the policy; it does not restore the previous one.

Required AWS IAM permissions

The credentials used to deploy this blueprint must allow the actions below. Resource scope: arn:aws:s3:::* (bucket-level) and arn:aws:s3:::*/* (object-level, only needed when force_destroy = true).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:PutBucketVersioning",
        "s3:GetEncryptionConfiguration",
        "s3:PutEncryptionConfiguration",
        "s3:GetBucketPublicAccessBlock",
        "s3:PutBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:PutBucketTagging",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketWebsite",
        "s3:GetBucketLogging",
        "s3:GetLifecycleConfiguration",
        "s3:GetReplicationConfiguration",
        "s3:GetAccelerateConfiguration",
        "s3:GetBucketRequestPayment",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketOwnershipControls"
      ],
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:ListBucketVersions"
      ],
      "Resource": "arn:aws:s3:::*/*"
    }
  ]
}

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Environment Variables & Secrets

Observability

Notifications

Networking & Advanced

Create it

Variables and outputs

Reference

Variables

Outputs

Upgrading to 1.2.0

Required AWS IAM permissions

​Create it

​Variables and outputs

​Reference

​Variables

​Outputs

​Upgrading to 1.2.0

​Required AWS IAM permissions

Create it

Variables and outputs

Reference

Variables

Outputs

Upgrading to 1.2.0

Required AWS IAM permissions