> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon S3

> S3 bucket with encryption, versioning, and public-access blocking

Qovery creates it in the AWS account of the environment's cluster, as a [Blueprint](https://www.qovery.com/docs/configuration/blueprints.md) service in one of your environments.

| | |
| - | - |
| Catalog name | `aws-s3` |
| Category | Storage |
| Provider | AWS |
| Engine | terraform |
| Major versions (latest release) | `default` (1.2.1) |
| Source | [AWS/s3/default](https://github.com/Qovery/service-catalog/tree/AWS/s3/default/1.2.1/AWS/s3/default) |

> [!TIP]
>
> **New to this?** You don't need to know Kubernetes or Terraform. Qovery sets up Amazon S3 in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

## Create it

> [tab] Console
>
> 1. Open the environment, then **New service** › **Blueprint**.
> 2. Find **Amazon S3** in the catalog and pick the major version.
> 3. Fill in the variables. Required ones are marked; the others use their defaults.
> 4. Create the service, and deploy it now or later.

> [tab] CLI and API
>
> List the catalog to get the latest tag, then create the service from it. `qovery api` signs the requests with your CLI session.
>
> ```bash theme={null}
> ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
> ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"
>
> qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "aws-s3")'
>
> cat > blueprint.json <<'EOF'
> {
>   "name": "aws-s3",
>   "tag": "AWS/s3/default/1.2.1",
>   "icon": "app://qovery-console/s3",
>   "variables": [
>     {
>       "name": "bucket_name",
>       "value": "REPLACE_WITH_BUCKET_NAME"
>     }
>   ],
>   "spec_overrides": {
>     "engine_version": "1.9.7"
>   }
> }
> EOF
> BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
> rm blueprint.json   # it can hold secret values
> qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
> qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment
> ```
>
> Replace each `REPLACE_WITH_` value. Add optional variables to `variables` the same way.

> [tab] Coding agent
>
> Paste this into Claude Code, Cursor, Codex or another coding agent with the [Qovery agent skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) installed (`curl -fsSL https://skill.qovery.com/install.sh | bash`).
>
> ```text Prompt wrap theme={null}
> Add the Qovery Blueprint Amazon S3 (aws-s3) to one of my Qovery environments and deploy it. Ask me for bucket_name.
> Ask me before deploying to a production environment.
> Docs: https://www.qovery.com/docs/configuration/blueprints/aws-s3.md
> ```

You don't add any file to your repository. Qovery creates the Blueprint from the Console or the API.

## Variables and outputs

Generated from `qbm.yml` at `AWS/s3/default/1.2.1`, the manifest the Console form is built from.

> [accordion] All 5 variables
>
> | Name | Type | Required | Default | Secret | Description |
> | - | - | - | - | - | - |
> | `bucket_name` | string | Yes | | | Globally unique, auto-lowercased: 3–63 letters, digits or hyphens, starting and ending with a letter or digit. No underscores. |
> | `versioning` | bool | | `true` | | Enable object versioning |
> | `encryption` | bool | | `true` | | Enable server-side encryption (AES-256) |
> | `force_destroy` | bool | | `false` | | Allow bucket deletion even if it contains objects |
> | `bucket_policy` | bool | | `true` | | Enforce TLS: attach a bucket policy that denies plain HTTP requests |

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint's name; see [Aliases Qovery creates for outputs](https://www.qovery.com/docs/configuration/environment-variables.md#aliases-qovery-creates-for-outputs) for the naming rules and the cases where no alias is created.

> [accordion] All 3 outputs
>
> | Name | Secret | Description |
> | - | - | - |
> | `bucket_arn` | | Bucket ARN |
> | `bucket_name` | | Bucket name |
> | `bucket_region` | | Bucket region |

## Reference

From the Blueprint's [README](https://github.com/Qovery/service-catalog/blob/AWS/s3/default/1.2.1/AWS/s3/default/README.md).

Creates an S3 bucket with encryption, versioning, and public access block configured. The bucket name is automatically lowercased before creation.

### Variables

| Name | Type | Required | Sensitive | Default | Description |
| - | - | - | - | - | - |
| `bucket_name` | string | yes | | — | Globally unique bucket name. Auto-lowercased. 3–63 chars; letters, digits, and hyphens only; must start and end with a letter or digit. Underscores, IP-address format, `xn--` prefix, and `-s3alias` suffix are rejected. |
| `versioning` | bool | no | | `true` | Enable object versioning |
| `encryption` | bool | no | | `true` | Enable AES-256 server-side encryption |
| `force_destroy` | bool | no | | `false` | Allow bucket deletion even if it contains objects |
| `bucket_policy` | bool | no | | `true` | Enforce TLS: attach a bucket policy that denies plain HTTP requests |

### Outputs

| Name | Description |
| - | - |
| `bucket_arn` | Bucket ARN |
| `bucket_name` | Bucket name (lowercased) |
| `bucket_region` | Bucket region |

### Upgrading to 1.2.0

`bucket_policy` defaults to `true`, so upgrading an existing bucket attaches the TLS policy. S3 holds a single policy per bucket: this one **replaces** any policy attached outside the blueprint. Preview the update before applying it (the plan shows `aws_s3_bucket_policy.this[0]` being created), and set `bucket_policy = false` if the bucket relies on a policy managed elsewhere. Setting it to `false` after the policy was replaced deletes the policy; it does not restore the previous one.

### Required AWS IAM permissions

The credentials used to deploy this blueprint must allow the actions below. Resource scope: `arn:aws:s3:::*` (bucket-level) and `arn:aws:s3:::*/*` (object-level, only needed when `force_destroy = true`).

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:PutBucketVersioning",
        "s3:GetEncryptionConfiguration",
        "s3:PutEncryptionConfiguration",
        "s3:GetBucketPublicAccessBlock",
        "s3:PutBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:PutBucketTagging",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketWebsite",
        "s3:GetBucketLogging",
        "s3:GetLifecycleConfiguration",
        "s3:GetReplicationConfiguration",
        "s3:GetAccelerateConfiguration",
        "s3:GetBucketRequestPayment",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketOwnershipControls"
      ],
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:ListBucketVersions"
      ],
      "Resource": "arn:aws:s3:::*/*"
    }
  ]
}
```


## Related topics

- [Use the ECR Pull Through Cache on Your Existing VPC](https://www.qovery.com/docs/configuration/integrations/aws/ecr-pull-through-cache-existing-vpc.md)
- [Object Storage](https://www.qovery.com/docs/configuration/object-storage.md)
- [Blueprints](https://www.qovery.com/docs/configuration/blueprints.md)
- [Use AWS IAM Roles with Qovery](https://www.qovery.com/docs/getting-started/guides/advanced-tutorials/aws-iam-roles.md)
- [Cluster Advanced Settings](https://www.qovery.com/docs/configuration/cluster-advanced-settings.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.