{
  "id": 14604815,
  "title": "Add S3 uploads to Vercel apps without storing long-lived AWS keys",
  "url": "https://urgent.news/2026/10/15/add-s3-uploads-to-vercel-apps-without-storing-long-lived-aws-keys",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T03:51:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/davekurian/add-s3-uploads-to-vercel-apps-without-storing-long-lived-aws-keys-5ggg"
  },
  "original_language": "en",
  "account": "A Vercel application can upload files to Amazon S3 without storing long-lived AWS access keys. Vercel's Amazon S3 Marketplace integration connects an S3 resource to a Vercel project, provides connection details as environment variables, and authenticates with short-lived OIDC credentials. The team is responsible for authorizing the uploader, selecting the object key, validating the file, and deciding who can read it. The guide covers the setup boundary, server-side upload path, and security decisions after handling credentials. This is intended for teams adding file uploads to a Vercel-hosted application, particularly those already using AWS and wanting storage flow near project configuration.",
  "summary": "A Vercel app can accept a file upload and store the object in Amazon S3 without putting a long-lived AWS access key in source code or deployment variables. Vercel’s Amazon S3 Marketplace integration now connects an S3 resource to a Vercel project, supplies connection details as environment variables, and authenticates with short-lived OIDC credentials. The practical work remains yours: authorize…",
  "key_points": [
    "Vercel app uploads to S3 without long-lived AWS keys",
    "Marketplace integration connects S3 resource to Vercel project",
    "OIDC credentials authenticate uploader with short lifespan"
  ],
  "editors_take": "Replacing long-lived access keys with short-lived OIDC credentials via marketplace integration reduces the security risks associated with managing static AWS credentials within Vercel-hosted application environments.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}