Getting started / Add-Ons /
S3 (Simple Storage Service)

S3 (Simple Storage Service)

Overview

S3 (Simple Storage Service) provides scalable object storage for your application. Tapitalee automatically provisions Amazon S3 buckets in your AWS account, offering secure, durable, and highly available storage for files, images, documents, backups, and static assets.

Purpose and Benefits

  • Scalable Storage: Virtually unlimited storage capacity that scales automatically
  • Durability: 99.999999999% (11 9’s) data durability with automatic redundancy
  • Availability: High availability with 99.99% uptime SLA
  • Security: Encryption at rest and in transit, fine-grained access controls
  • Cost-Effective: Pay only for storage used, with multiple storage classes
  • Integration: Easy integration with applications via AWS SDKs and REST APIs

AWS Service Details

Under the hood, Tapitalee creates:

  • S3 Bucket: Secure storage container with unique global name
  • Bucket Policies: Access control policies for security

CLI Usage

Create S3 Bucket

Create an S3 bucket for file storage

tapit create s3 name=bucket_name [description='My bucket'] [public_access=true|false] [external_access=true|false] [secret=true|false] [--ignore-existing]

Parameters

  • name: Name for the S3 bucket (required)
  • description: Description of the bucket’s purpose
  • public_access: Allow public access to bucket contents (true/false)
  • external_access: Provision IAM users for external access to the bucket (true/false)
  • secret: Treat the bucket as secret (true/false). Regular team members and read-only API/CLI users cannot read its contents without the view secrets permission
  • --ignore-existing: Skip creation if a resource with the same name already exists (useful for idempotent scripts)

Examples 

# Basic private S3 bucket
tapit create s3 name=myapp-documents

# Public bucket for static assets
tapit create s3 name=myapp-static-assets description='Public static files' public_access=true

# Bucket for user uploads
tapit create s3 name=myapp-user-uploads description='User uploaded files'

Modify S3 Bucket

Update settings for an existing S3 bucket

tapit set s3 name=bucket_name [description='New description'] [external_access=true|false] [secret=true|false] [delete_protection=true|false]

Parameters

  • name: Name of the S3 bucket to update (required)
  • description: Description of the bucket’s purpose
  • external_access: Provision IAM users for external access to the bucket (true/false)
  • secret: Treat the bucket as secret (true/false). Regular team members and read-only API/CLI users cannot read its contents without the view secrets permission
  • delete_protection: Enable (true) or disable (false) delete protection for the bucket

List and Show S3 Buckets

List all add-ons attached to the app with their state and configuration

tapit list addons [-w|--wait]

Parameters

  • -w|--wait: Wait until all add-ons reach a stable state (fully ready or fully deleted); exits non-zero if any add-on is in a failed state

Show detailed information about a specific add-on

tapit show addon name=addon_name

Parameters

  • name: Name of the add-on to show (required)

Delete S3 Bucket

Delete an add-on and all its associated AWS resources

tapit delete addon name=addon_name

Parameters

  • name: Name of the add-on to delete (required)

Warning: This permanently deletes the S3 bucket. The bucket must be empty before deletion.

Environment Variables

When you create an S3 bucket, Tapitalee automatically injects connection details as environment variables:

  • S3_BUCKET: Bucket name

Security and Access Control

Tapitalee manages all IAM policies and permissions internally — there is nothing you need to configure manually.

The public_access Setting

The public_access parameter controls whether bucket objects are publicly readable:

  • public_access=false (default): Objects are private. Your deployed app has full read/write access to the bucket, but no one else can access the contents without AWS credentials.

  • public_access=true: Objects are publicly readable (but not listable). Anyone can access an object directly via its URL — no signed links or AWS credentials required. This is useful for serving static assets or sharing files via direct links. Your deployed app still has full access.

The secret Setting

The secret parameter controls who on your team can browse the bucket’s contents through Tapitalee:

  • secret=false (default): Any team member with view access to the app can browse the bucket’s contents.

  • secret=true: The bucket is treated as secret. Regular team members and read-only API/CLI users cannot read its contents without the view secrets permission. This is useful for buckets holding sensitive files that should only be visible to members granted secret-viewing access.

Common Use Cases

File Uploads and Storage 

# Create bucket for user file uploads
tapit create s3 name=myapp-uploads description='User uploaded files'

Static Asset Hosting 

# Create public bucket for static assets
tapit create s3 name=myapp-static public_access=true description='CSS, JS, images'

Document Archive 

# Create bucket for document storage
tapit create s3 name=myapp-documents description='Document archive and backup'

Application Backups 

# Create bucket for application backups
tapit create s3 name=myapp-backups description='Database and application backups'