Amazon S3¶

S3 is recommended for production deployments. It stores module archives and provider binaries with SHA256 checksum validation.

Configuration¶

Field	Type	Required	Description
`bucket`	string	Yes	S3 bucket name
`region`	string	Yes	AWS region, such as `us-west-2`
`key`	string	No	Object key prefix for stored artifacts

storageConfig:
  s3:
    bucket: opendepot-modules
    region: us-west-2

Authentication¶

OpenDepot uses the AWS SDK v2 default credentials chain. Common Kubernetes deployments use:

EKS with IRSA: Annotate the Version controller's ServiceAccount with an IAM role ARN. This is the recommended option.
Environment variables: Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and optionally AWS_SESSION_TOKEN.
EC2 instance profile: Use the profile available to the EKS nodes.

IAM Permissions¶

{
  "Effect": "Allow",
  "Action": [
    "s3:GetObject",
    "s3:PutObject",
    "s3:DeleteObject",
    "s3:GetObjectAttributes"
  ],
  "Resource": "arn:aws:s3:::your-bucket-name/*"
}

S3 requires no additional IAM permissions for pre-signed provider downloads; s3:GetObject is sufficient. See Pre-signed URL Redirects for configuration.