clg-storage-s3 · optional provider
Put civic files on durable, agency-controlled object storage.
Move managed documents, meeting packets, recordings, and feedback attachments to Amazon S3 or a compatible provider while every Crumina permission and visibility rule remains in force.
Explore featuresAll add-onsAmazon S3 connection
ConnectedBucket
Region
Encryption
Connection test passed.
Write, read, URL signing, and delete checks completed.
Write, read, URL signing, and delete checks completed.
Test connection
Why S3
Scale storage without weakening access control
Private by defaultManaged objects stay private and are never exposed through a public bucket listing.
Short-lived deliveryAuthorized downloads use signed, expiring URLs created only after Crumina checks access.
Provider choiceCustom endpoints support compatible services such as MinIO and DigitalOcean Spaces.
Feature set
Agency storage, managed from WordPress
Staff configure one site-wide provider. Each feature module keeps its own path prefix and remains responsible for deciding who may access a file.
Security boundary
Storage supplies bytes and signed URLs. Crumina modules still perform the authorization check before either is returned.
- Amazon S3 and compatible endpoints
- Configurable bucket, region, and key prefix
- Path-style endpoint support
- Automatic content type metadata
- Optional KMS key encryption
- Configurable signed URL lifetime
- Encrypted credentials at rest
- Built-in connection test
Protected delivery
A download stays private from click to byte
1. Resident requests a fileThe owning module receives a document or attachment download request.
2. Crumina checks accessVisibility, capability, and publication rules are re-evaluated and the event can be audited.
3. S3 signs deliveryA short-lived URL is issued for that authorized request; the bucket remains private.
Try it
See managed S3 storage in action
Walk through configuration, a connection test, protected document delivery, and the way each module keeps its own access rules.