S3 Storage

Primary bucket + CRR replica; versioning, SSE, Block-public-access, 100-day lifecycle

S3 Architecture

The SSM.ro platform uses two AWS S3 buckets in distinct regions:

Bucket	Role	Application access
S3 Primary	Main storage for document content	Yes — read and write via authenticated API
S3 CRR Replica	Passive backup/DR in a separate region	No — no application reads/writes directly from the replica

Primary Bucket Configuration

Parameter	Configuration
Block Public Access	Enabled on the entire bucket — no public exposure possible
Versioning	Enabled — protection against accidental deletion or overwriting
Server-Side Encryption (SSE)	Enabled — all objects encrypted at rest
Lifecycle rule	`expire-deleted-objects` — noncurrent versions retained for a maximum of 100 days, then permanently deleted
Access	Exclusively via authenticated API (least-privilege IAM credentials)

Cross-Region Replication (CRR)

All objects in the primary bucket are automatically replicated to an S3 bucket in another AWS region:

Replication is managed by AWS — no manual intervention required
The replica has the same security settings (SSE, versioning)
The replica is used exclusively as a passive backup for DR (Disaster Recovery)
In the event of a regional outage or massive data loss in the primary region, documents can be recovered from the replica

Lifecycle Rules

expire-deleted-objects

Status: Enabled
Scope: Entire bucket

Current version actions:
  Day 0 — No actions defined

Noncurrent version actions:
  Day 0 — Objects become noncurrent
  Day 100 — 0 noncurrent versions retained
            All other noncurrent versions permanently deleted

This rule ensures that deleted files (marked with delete markers) do not occupy space indefinitely.

S3 RPO

Cross-region replication ensures an RPO ≤ 15 minutes for documents.

Access and Authentication

Access to S3 is exclusively via authenticated API — no object is publicly accessible
AWS credentials have minimal permissions (least-privilege IAM) — access restricted to the application's buckets
Credentials are stored in Heroku config vars, not in source code