# s3nd with AWS S3

> Move files and local-first app data through a AWS S3 bucket with s3nd: the createBucket() configuration, the CLI starter, and what to know about this provider.

Canonical: https://www.s3nd.sh/providers/aws-s3 · Markdown: https://www.s3nd.sh/providers/aws-s3.md · Français: https://www.s3nd.sh/fr/providers/aws-s3

The original. Credentials come from the provider chain, so a Lambda or an ECS task needs no keys at all.

**createBucket()**
```ts
import { createBucket } from '@s3nd/core'

// Credentials from the AWS provider chain: env, shared config, or the role.
const store = createBucket({
  bucket: process.env.S3_BUCKET,
  region: 'eu-west-3',
  prefix: 'transfers',
  maxSize: 4 * 1024 * 1024,
})
```

## Why this one
On AWS, s3nd is the AWS SDK v3 with the transfer semantics on top. Omit credentials and the default provider chain applies: environment variables, the shared config file, or the role attached to the instance, task or function. Nothing to store, nothing to rotate.

## A starter configuration, and what is left to do.
init writes the file with ${VAR} references rather than secrets, so it is meant to be committed; the env file it points at is not.

```sh
s3nd init --provider aws --bucket transfers
```
**s3nd.config.json**
```json
{
  "bucket": "transfers",
  "region": "eu-west-3",
  "prefix": "transfers",
  "expiresIn": "24h"
}
```

### Then
1. Give the machine credentials the usual way: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, a profile, or a role.
2. Add a lifecycle rule on the transfers/ prefix that expires objects after a day or two.
3. Run `s3nd doctor`. It performs the operations s3nd needs and reports what happened.

## Notes on S3.
- **Virtual-hosted addressing** — Without an endpoint, s3nd leaves path-style addressing off, which is what S3 proper expects. Set forcePathStyle yourself only if a gateway in front demands it.
- **ACLs are off by default** — Buckets created after 2023 have "bucket owner enforced" on. Make objects public with a bucket policy or a CDN, and leave the acl option alone.
- **Expiry cleanup** — expiresIn stops a transfer being handed over; only a lifecycle rule deletes the object. Give the prefix a rule that expires objects after a day or two, and s3nd doctor turns green.

[The full guide](https://doc.s3nd.sh/docs/providers)