Provisions an object storage bucket on AWS (S3), GCP (Cloud Storage), or Azure (Blob Storage) with sensible defaults: server-side encryption always on, public access blocked, and no static access keys. Pick a name, decide on versioning and lifecycle rules, and the blueprint handles the rest.
Workloads authenticate with their cloud identity, never with keys. On AWS, list the services that should get access under Target Services. On GCP and Azure, access is granted through the workload identity blueprint using this bucket's workloadGrants output; until that is wired up, no workload can reach the bucket.
Use the native client for each cloud: the AWS S3 SDK, the Google Cloud Storage SDK, or the Azure Storage SDK (endpoint is the service endpoint for each). GCS also exposes an S3-compatible endpoint, but S3 SDKs against it require HMAC keys, which this blueprint does not create.
To use your own encryption key, the key must already exist and the bucket's service identity must be able to use it: on AWS the KMS key policy must allow the account's IAM principals; on GCP the project's Cloud Storage service agent needs roles/cloudkms.cryptoKeyEncrypterDecrypter on the key; on Azure you supply a user-assigned managed identity that already holds Key Vault Crypto Service Encryption User on the vault, which must use RBAC authorization with purge protection enabled. Ryvn never grants itself or the bucket access to your key.
This blueprint accepts 14 configurable inputs to customize the installation for your environment.
bucketNamestringDesired name for the bucket. A short random suffix is appended automatically to guarantee global uniqueness. Leave blank to use the default prefix "bucket".
versioningbooleanKeep previous versions of objects. Useful for recovery from accidental overwrites or deletes. Once enabled, versioning can be suspended but not fully removed.
encryptionKeyIdstringCustomer-managed encryption key for data at rest (KMS key ARN on AWS, Cloud KMS key on GCP, Key Vault key on Azure). Leave blank to use the cloud provider's managed keys.
encryptionKeyIdentityIdstringUser-assigned managed identity the storage account uses to access the Key Vault key. It must already have Key Vault Crypto Service Encryption User on the vault. Required with an encryption key on Azure.
expirationDaysnumberAutomatically delete objects after this many days. Set to 0 to keep objects indefinitely.
noncurrentVersionExpirationDaysnumberDelete noncurrent versions after this many days. Only applies when versioning is enabled. Set to 0 to keep old versions indefinitely.
targetServiceInstallationsarrayInstallation names of services that should get read/write access to this bucket.
enableCorsbooleanAllow browsers to make direct cross-origin requests to this bucket.
corsAllowedOriginsarrayBrowser origins allowed to access this bucket directly.
corsAllowedMethodsarrayHTTP methods browsers may use for direct cross-origin requests to this bucket.
corsAllowedHeadersarrayRequest headers browsers may send for cross-origin requests.
corsExposeHeadersarrayResponse headers browsers may expose to JavaScript.
corsMaxAgeSecondsnumberHow long browsers should cache successful CORS preflight responses.
deletionProtectionbooleanProtects the bucket from accidental destruction. On AWS and GCP the bucket cannot be destroyed while it contains objects. On Azure a CanNotDelete lock on the storage account blocks out-of-band deletes (portal, CLI), but uninstalling this blueprint still removes the account and its data.
This blueprint exposes 12 outputs that other services can reference.
bucketNamestringFull name of the bucket, including the random suffix.
bucketIdstringCloud-native identifier for the bucket (an ARN on AWS, a self link on GCP, the container's Resource Manager ID on Azure).
connectionUrlstringHTTP connection URL for the bucket (e.g. https://my-bucket.s3.us-east-1.amazonaws.com, https://my-bucket.storage.googleapis.com, https://myaccount.blob.core.windows.net/my-container).
endpointstringObject storage service endpoint for SDK configuration. S3-compatible on AWS (regional S3 endpoint) and GCP (https://storage.googleapis.com, the GCS XML API); the storage account's blob endpoint on Azure (Azure SDK only).
regionstringCloud region or location where the bucket lives.
encryptionKeyIdstringCustomer-managed key encrypting the bucket, or empty when provider-managed keys are used.
workloadGrantsstringJSON list of grants for the workload identity module, in the provider's shape (AWS `[{ policy_arn }]`, GCP `[{ kind, target, role }]`, Azure `[{ scope, role_definition_name }]`).
iamPolicyArnstringARN of the managed IAM policy granting read/write access to this bucket. Attach it to a workload identity role group via `policy_arns`.
iamRolestringIAM role to bind on the bucket for workload principals (with `bucketName`) via a workload identity role group's `buckets`.
storageAccountNamestringName of the storage account that holds the container.
roleAssignmentScopestringResource Manager ID of the container to use as the scope of a workload identity role assignment.
roleDefinitionNamestringBuilt-in Azure role granting read/write access to blobs in the container.