AWS S3 provider for Strapi uploads
# using yarn
yarn add @strapi/provider-upload-aws-s3
# using npm
npm install @strapi/provider-upload-aws-s3 --save
provider
defines the name of the providerproviderOptions
is passed down during the construction of the provider. (ex: new AWS.S3(config)
). Complete list of optionsproviderOptions.params
is passed directly to the parameters to each method respectively.ACL
is the access control list for the object. Defaults to public-read
.signedUrlExpires
is the number of seconds before a signed URL expires. (See how signed URLs work). Defaults to 15 minutes and URLs are only signed when ACL is set to private
.Bucket
is the name of the bucket to upload to.actionOptions
is passed directly to the parameters to each method respectively. You can find the complete list of upload/ uploadStream options and delete optionsSee the documentation about using a provider for information on installing and using a provider. To understand how environment variables are used in Strapi, please refer to the documentation about environment variables.
If you're using the bucket as a CDN and deliver the content on a custom domain, you can get use of the baseUrl
and rootPath
properties to configure how your assets' urls will be saved inside Strapi.
./config/plugins.js
or ./config/plugins.ts
for TypeScript projects:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
module.exports = ({ env }) => ({
// ...
upload: {
config: {
provider: 'aws-s3',
providerOptions: {
baseUrl: env('CDN_URL'),
rootPath: env('CDN_ROOT_PATH'),
s3Options: {
accessKeyId: env('AWS_ACCESS_KEY_ID'),
secretAccessKey: env('AWS_ACCESS_SECRET'),
region: env('AWS_REGION'),
params: {
ACL: env('AWS_ACL', 'public-read'),
signedUrlExpires: env('AWS_SIGNED_URL_EXPIRES', 15 * 60),
Bucket: env('AWS_BUCKET'),
},
},
},
actionOptions: {
upload: {},
uploadStream: {},
delete: {},
},
},
},
// ...
});
If your bucket is configured to be private, you will need to set the ACL
option to private
in the params
object. This will ensure file URLs are signed.
Note: If you are using a CDN, the URLs will not be signed.
You can also define the expiration time of the signed URL by setting the signedUrlExpires
option in the params
object. The default value is 15 minutes.
./config/plugins.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
module.exports = ({ env }) => ({
// ...
upload: {
config: {
provider: 'aws-s3',
providerOptions: {
accessKeyId: env('AWS_ACCESS_KEY_ID'),
secretAccessKey: env('AWS_ACCESS_SECRET'),
region: env('AWS_REGION'),
params: {
ACL: 'private', // <== set ACL to private
signedUrlExpires: env('AWS_SIGNED_URL_EXPIRES', 15 * 60),
Bucket: env('AWS_BUCKET'),
},
},
actionOptions: {
upload: {},
uploadStream: {},
delete: {},
},
},
},
// ...
});
This plugin may work with S3 compatible services by using the endpoint
option instead of region
. Scaleway example:
./config/plugins.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
module.exports = ({ env }) => ({
// ...
upload: {
config: {
provider: 'aws-s3',
providerOptions: {
accessKeyId: env('SCALEWAY_ACCESS_KEY_ID'),
secretAccessKey: env('SCALEWAY_ACCESS_SECRET'),
endpoint: env('SCALEWAY_ENDPOINT'), // e.g. "s3.fr-par.scw.cloud"
params: {
Bucket: env('SCALEWAY_BUCKET'),
},
},
},
},
// ...
});
Due to the default settings in the Strapi Security Middleware you will need to modify the contentSecurityPolicy
settings to properly see thumbnail previews in the Media Library. You should replace strapi::security
string with the object bellow instead as explained in the middleware configuration documentation.
./config/middlewares.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
module.exports = [
// ...
{
name: 'strapi::security',
config: {
contentSecurityPolicy: {
useDefaults: true,
directives: {
'connect-src': ["'self'", 'https:'],
'img-src': [
"'self'",
'data:',
'blob:',
'market-assets.strapi.io',
'yourBucketName.s3.yourRegion.amazonaws.com',
],
'media-src': [
"'self'",
'data:',
'blob:',
'market-assets.strapi.io',
'yourBucketName.s3.yourRegion.amazonaws.com',
],
upgradeInsecureRequests: null,
},
},
},
},
// ...
];
If you use dots in your bucket name, the url of the ressource is in directory style (s3.yourRegion.amazonaws.com/your.bucket.name/image.jpg
) instead of yourBucketName.s3.yourRegion.amazonaws.com/image.jpg
. Then only add s3.yourRegion.amazonaws.com
to img-src and media-src directives.
If you are planning on uploading content like GIFs and videos to your S3 bucket, you will want to edit its CORS configuration so that thumbnails are properly shown in Strapi. To do so, open your Bucket on the AWS console and locate the Cross-origin resource sharing (CORS) field under the Permissions tab, then amend the policies by writing your own JSON configuration, or copying and pasting the following one:
1
2
3
4
5
6
7
8
9
[
{
"AllowedHeaders": ["*"],
"AllowedMethods": ["GET"],
"AllowedOrigins": ["YOUR STRAPI URL"],
"ExposeHeaders": [],
"MaxAgeSeconds": 3000
}
]
These are the minimum amount of permissions needed for this provider to work.
1
2
3
4
5
6
7
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:DeleteObject",
"s3:PutObjectAcl"
],
npm install @strapi/provider-upload-aws-s3
Check out the available plugin resources that will help you to develop your plugin or provider and get it listed on the marketplace.