medusa-plugin-aws-storage

Upload files to an AWS S3 bucket. Optionally serve files through CloudFront.

Options

| Option | Description | Required | Example | |-----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|--------------------| | region | AWS region | Yes | us-east-1 | | access_key_id | AWS Access Key ID | Yes | | | secret_access_key | AWS Secret Access Key | Yes | | | s3_bucket | S3 bucket name. This can be omitted if cloud_front_distribution_id is provided and CloudFront distribution has an S3 origin. | Conditionally | | | s3_origin_path | S3 origin. If cloud_front_distribution_id is provided then origin path has to be part of the distribution's S3 origins. If cloud_front_distribution_id is provided and s3_origin_path is not provided, then the distribution's default cache behavior's origin path will be used. Defaults to ''. | | /assets | | s3_upload_options | S3 upload options | | {} | | s3_upload_options.ACL | S3 ACL | | public-read | | s3_upload_options.CacheControl | S3 Cache Control | | max-age=31536000 | | s3_upload_options.ServerSideEncryption | S3 Server Side Encryption | | AES256 | | s3_upload_options.StorageClass | S3 Storage Class | | STANDARD | | cloud_front_distribution_id | CloudFront Distribution ID. Required if s3_bucket is not provided. CloudFront distribution must have an S3 origin. | Conditionally | | | cloud_front_cache_behavior_path_pattern | CloudFront Cache Behavior Path Pattern. Used when other than default cache behavior needs to be used. If not provided, then the default cache behavior will be used. Ignored when cloud_front_distribution_id is not provided. | | images/* | | cloud_front_key_pair_id | CloudFront Key Pair ID. Required if cloud_front_distribution_id is provided and signed URLs will be used. | Conditionally | | | cloud_front_key_private_key | CloudFront Key Private Key. Required if cloud_front_distribution_id is provided and signed URLs will be used. | Conditionally | | | domain_name | Domain name. If cloud_front_distribution_id is provided then domain name has to be part of the distribution's aliases. If cloud_front_distribution_id is provided and domain_name is not provided, then the 1st distribution alias will be used. Defaults to S3 Bucket URL. | | my-domain.com | | download_url_duration | The number of seconds before the signed URL expires | | 3600 | | use_https | Whether to use http or https | | true |

Usage

const plugins = [
  // ...
  {
    resolve: `medusa-plugin-aws-storage`,
    options: {
      region: process.env.S3_REGION,
      access_key_id: process.env.S3_ACCESS_KEY_ID,
      secret_access_key: process.env.S3_SECRET_ACCESS_KEY,
      s3_bucket: process.env.S3_BUCKET,
    },
  },
]

S3 Bucket Policy

{
  "Version": "2012-10-17",
  "Id": "Policy1397632521960",
  "Statement": [
    {
      "Sid": "Stmt1397633323327",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::<YOUR_BUCKET_NAME>/*"
    }
  ]
}

User Permissions

Your user must have the AmazonS3FullAccess policy attached to it. You can refer to this guide to learn how to add a policy if necessary.

If using CloudFront, your user must have the CloudFrontFullAccess policy attached to it.

CloudFront Signed URLs

Please note the process for creating a signed URL with Cloudfront is very different from the process for S3. For more information, please visit the documentation for restricting CloudFront content with signed URLs and signed cookies.