s3

Source: builtin/s3

Amazon S3, S3-compatible object stores (MinIO, R2, LocalStack), and Google Cloud Storage.

Provider configuration

Name	Type	Required	Default	Description
`access_key_id`	`string`	no	—	Static access key (an HMAC key with `gcs`). Set with `secret_access_key`.
`endpoint`	`string`	no	—	Base URL of an S3-compatible store, such as `http://localhost:9000` for MinIO.
`gcs`	`bool`	no	`false`	Talk to Google Cloud Storage, with Application Default Credentials unless HMAC keys are set.
`path_style`	`bool`	no	`false`	Address buckets as `host/bucket` rather than `bucket.host`. MinIO and LocalStack usually need `true`.
`profile`	`string`	no	—	Shared-config profile to use instead of `AWS_PROFILE`.
`project`	`string`	no	—	Google Cloud project for new buckets. Only with `gcs`.
`region`	`string`	no	—	Region for requests and new buckets. Defaults to `us-east-1`, or `auto` with `gcs`. R2 uses `auto`.
`secret_access_key`	`string`	no	—	Static secret key. Pass it through a variable or `env()`.
`session_token`	`string`	no	—	Session token for temporary static credentials.

Actions

`s3_create_bucket`

Create a bucket. With exists_ok (the default), a bucket you already own is used as it is, with created = false. A name someone else owns is an error.

Make sure a local MinIO has the uploads bucket.

action "s3_create_bucket" "uploads" {
  bucket = "app-uploads"
}

Attributes

Name	Type	Required	Default	Description
`bucket`	`string`	yes	—	Bucket name.
`exists_ok`	`bool`	no	`true`	Whether a bucket that already exists is fine.

Outputs

Type: object({bucket=string,created=bool}).

Field	Type	Description
`bucket`	`string`	The bucket name.
`created`	`bool`	Whether the action created it.

`s3_delete_bucket`

Delete an empty bucket.

Attributes

Name	Type	Required	Default	Description
`bucket`	`string`	yes	—	Bucket name.

Outputs

Type: object({}).

None.

`s3_delete_object`

Delete an object. Deleting one that doesn’t exist succeeds.

Attributes

Name	Type	Required	Default	Description
`bucket`	`string`	yes	—	Bucket name.
`key`	`string`	yes	—	Object key.

Outputs

Type: object({}).

None.

`s3_put_object`

Upload an object from inline text, base64, or a file next to the scenario. Set exactly one of content, content_base64 and file. Files are streamed, not read into memory.

Upload an avatar for a seeded user and store its key on the row.

action "s3_put_object" "avatar" {
  bucket = action.s3_create_bucket.uploads.bucket
  key    = "avatars/${action.postgres_insert.user.id}.png"
  file   = "./fixtures/avatar.png"
}

action "postgres_update" "user_avatar" {
  table = "users"
  set   = { avatar_key = action.s3_put_object.avatar.key }
  where = { id = action.postgres_insert.user.id }
}

Attributes

Name	Type	Required	Default	Description
`bucket`	`string`	yes	—	Bucket name.
`content`	`string`	no	—	Object content as text.
`content_base64`	`string`	no	—	Object content, base64-encoded, for small binaries.
`content_type`	`string`	no	—	Content type. Defaults to one guessed from the key’s extension, then `application/octet-stream`.
`file`	`string`	no	—	Path to a file to upload, relative to the scenario file.
`key`	`string`	yes	—	Object key.
`metadata`	`map(string)`	no	—	User metadata (`x-amz-meta-*`).
`on_conflict`	`string`	no	`"update"`	What to do when the object already exists: `"update"` overwrites it, `"ignore"` leaves it and returns its `etag` and `size`.

Outputs

Type: object({bucket=string,created=bool,etag=string,key=string,size=number}).

Field	Type	Description
`bucket`	`string`	The bucket name.
`key`	`string`	The object key.
`etag`	`string`	The object’s ETag, without quotes.
`size`	`number`	Size in bytes.
`created`	`bool`	Whether the object was new.

Notes

Credentials come from the standard AWS chain unless set in the config: environment variables, AWS_PROFILE and shared config (SSO included), web identity, and container and instance roles.
With gcs = true the provider talks to Google Cloud Storage’s XML API and authenticates with Application Default Credentials (gcloud auth application-default login, a service-account key file, or workload identity). Set access_key_id and secret_access_key to use HMAC keys instead.
orchard teardown undoes the actions automatically, unless an action has its own lifecycle { teardown { } } block or sets lifecycle { managed_teardown = false }. A bucket or object the scenario created is deleted. Before overwriting an object, s3_put_object copies it to .orchard-backup/<run>/<key> in the same bucket; teardown copies it back when an earlier action in the run created the object, or with managed_teardown = true, and deletes the backup either way. Other overwritten objects are left as written. Without automatic teardown the backup stays in the bucket.
Buckets are deleted only when empty, so objects the scenario didn’t create keep a created bucket alive through teardown.

redis sqlite