S3 Storage

A CAIP Apps deployment can receive access to the usecase's S3 by enabling one flag. S3 access is disabled unless you opt in.

Enable S3 Access

Add s3_access: true under additional_config when creating or updating a deployment:

{
  "deploy_name": "my-deployment",
  "image_tag": "1.0.0",
  "additional_config": {
    "s3_access": true
  }
}

When enabled, the application receives these environment variables:

Environment variable	Meaning
CAIP_STORAGE_BUCKET_NAME	The S3 bucket assigned to the usecase. Is stage agnostic.
CAIP_STORAGE_PREFIX	The recommended storage path for this application deployment

The bucket name and prefix are generated by the platform. You don't need to provide your own bucket or prefix values in the deployment request.

If s3_access is false, omitted, or null, these environment variables are not added.

Use S3 From Your Application - Boto3

Install boto3 in your application and use the environment variables:

import os

import boto3

bucket = os.environ["CAIP_STORAGE_BUCKET_NAME"]
prefix = os.environ["CAIP_STORAGE_PREFIX"].rstrip("/")
key = f"{prefix}/example.txt"

boto3.client("s3").put_object(
    Bucket=bucket,
    Key=key,
    Body=b"Hello from CAIP Apps\n",
    ContentType="text/plain",
)

You do not need to provide AWS access keys. The deployed application uses its platform-managed identity, and boto3 discovers the credentials automatically.

Beware! Manage Your Data Carefully

You are fully responsible for the data your application writes to S3, including naming, retention, cleanup, and any sensitive content.

Use CAIP_STORAGE_PREFIX as the root for your application data. If your code writes outside that path, it may overwrite or interfere with data belonging to another application or deployment. The prefix is currently a platform convention and should be treated as a required application boundary.