Configure Object Storage
Storage components create Amazon S3 buckets. They can remain private, allow public reads, or expose content through a CDN and custom domain.
Create Storage
- Open an infrastructure configuration and select Add component > Storage.
- Enter a descriptive name.
- Keep Public read access disabled unless every stored object is intended to be public.
- Enable CDN when the application needs a public URL backed by CloudFront.
- If a CDN is enabled, select a configured domain where appropriate.
- Select quick metrics and operational metrics.
- Grant services only the read or write access they need.
- Configure event handlers or alternate routes if required.
- Choose the removal policy for every environment and save.
Private and Public Content
Private buckets are the default choice for uploads, backups, reports, and application data. Public reads or a CDN are appropriate only for assets meant for anonymous consumption.
Public Means Public
Do not enable public reads for a bucket that may contain customer data, logs, secrets, or internal artifacts. Use application-authorised downloads or time-limited signed URLs instead.
Service Permissions
Grant read to services that retrieve objects and write to services that create or update them. Use the storage-derived bucket name in environment variables rather than hard-coding the generated AWS name.
Removal Policy
Use Keep for persistent data. S3 buckets may also resist deletion while objects remain, so plan explicit retention and cleanup rather than relying on infrastructure removal as a data-lifecycle mechanism.