Connecting Bubble to AWS services uses the API Connector with AWS Signature v4 authentication or pre-signed URLs. The most common use case is S3 for file storage, but you can also connect to Lambda, SES, and other services. This tutorial covers S3 integration for uploading, listing, and downloading files.
Overview: Integrating Amazon AWS with Bubble
AWS provides enterprise-grade cloud services that complement Bubble's built-in capabilities. The most common integration is Amazon S3 for file storage — useful when you need more storage than Bubble offers, or need to share files with other systems. This tutorial focuses on S3 but the API Connector pattern works for any AWS service.
Prerequisites
- An AWS account with S3 access
- An IAM user with programmatic access and S3 permissions
- The API Connector plugin installed in Bubble
- Basic understanding of REST APIs and the API Connector
Step-by-step guide
Create an IAM user with S3 permissions in AWS
Create an IAM user with S3 permissions in AWS
Log in to the AWS Console. Go to IAM → Users → Add users. Create a user with programmatic access. Attach the AmazonS3FullAccess policy (or create a custom policy with limited S3 permissions for your specific bucket). Save the Access Key ID and Secret Access Key — you will need these in Bubble.
Pro tip: Create a custom IAM policy that restricts access to only the specific S3 bucket your app uses, rather than granting full S3 access.
Expected result: You have an IAM user with Access Key ID and Secret Access Key for S3 operations.
Set up the API Connector for S3 pre-signed URL generation
Set up the API Connector for S3 pre-signed URL generation
Since AWS Signature v4 is complex to implement directly in Bubble, the recommended approach is to use a Lambda function or a lightweight server that generates pre-signed URLs. Alternatively, use a Bubble plugin like the AWS File Uploader that handles signing. In the API Connector, create a call to your signing endpoint that returns a pre-signed S3 URL for uploading.
1{2 "endpoint": "POST https://your-lambda.execute-api.us-east-1.amazonaws.com/presign",3 "body": {4 "bucket": "your-bucket-name",5 "key": "uploads/filename.pdf",6 "contentType": "application/pdf",7 "expiresIn": 3008 },9 "response": {10 "uploadUrl": "https://your-bucket.s3.amazonaws.com/uploads/filename.pdf?X-Amz-Algorithm=...",11 "fileUrl": "https://your-bucket.s3.amazonaws.com/uploads/filename.pdf"12 }13}Expected result: The API call returns a pre-signed URL that allows temporary upload access to your S3 bucket.
Upload files to S3 from Bubble
Upload files to S3 from Bubble
After getting the pre-signed URL from step 2, use another API Connector call to PUT the file directly to S3. Set the method to PUT, the URL to the pre-signed URL (dynamic parameter), and the body to the file content from the File Uploader element. This sends the file directly to S3 without passing through Bubble's servers for storage.
Expected result: Files from Bubble's File Uploader are stored directly in your S3 bucket.
List files from S3 in your app
List files from S3 in your app
Create an API call to S3's ListObjectsV2 endpoint (or through your Lambda function). The response includes file names, sizes, and last modified dates. Display these in a Repeating Group. For each file, construct the S3 URL for display or generate a pre-signed download URL for temporary access.
Expected result: Users see a list of files stored in S3 within your Bubble app.
Generate download URLs for S3 files
Generate download URLs for S3 files
For private S3 buckets, generate pre-signed download URLs via your Lambda function. The URL is valid for a limited time (e.g., 5 minutes). Display a Download button that opens the pre-signed URL in a new tab. For public buckets, construct the direct URL: https://bucket-name.s3.region.amazonaws.com/key.
Expected result: Users can download files from your S3 bucket through your Bubble app.
Complete working example
1AWS S3 INTEGRATION SUMMARY2============================34ARCHITECTURE:5 Bubble → Lambda (signing) → S3 (storage)6 Lambda generates pre-signed URLs for upload/download7 Files go directly to S3, not stored in Bubble89API CONNECTOR CALLS:10 1. Get Upload URL (Action)11 POST https://your-lambda/presign12 Body: { bucket, key, contentType, expiresIn }13 Returns: { uploadUrl, fileUrl }1415 2. Upload to S3 (Action)16 PUT [uploadUrl from step 1]17 Body: file content from File Uploader18 Headers: Content-Type: [file mime type]1920 3. List Files (Data)21 GET https://your-lambda/list22 Params: { bucket, prefix }23 Returns: { files: [{ key, size, lastModified }] }2425 4. Get Download URL (Action)26 POST https://your-lambda/download-url27 Body: { bucket, key, expiresIn }28 Returns: { downloadUrl }2930BUBBLE WORKFLOW:31 Upload button clicked:32 1. Call Get Upload URL (filename, type)33 2. Call Upload to S3 (uploadUrl, file)34 3. Save fileUrl to database record3536 Download button clicked:37 1. Call Get Download URL (file key)38 2. Open external website: Result's downloadUrl3940IAM POLICY (recommended, restrict to one bucket):41 {42 "Effect": "Allow",43 "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket"],44 "Resource": [45 "arn:aws:s3:::your-bucket",46 "arn:aws:s3:::your-bucket/*"47 ]48 }Common mistakes when integrating AWS with Bubble
Why it's a problem: Putting AWS Secret Access Key in client-side code or Bubble's frontend
How to avoid: Keep the Secret Access Key in a Lambda function or backend service. Only pass pre-signed URLs to Bubble.
Why it's a problem: Granting AmazonS3FullAccess instead of a bucket-specific policy
How to avoid: Create a custom IAM policy that restricts access to only the specific bucket and operations your app needs
Why it's a problem: Not setting CORS on the S3 bucket
How to avoid: Add a CORS policy to your S3 bucket allowing PUT and GET from your Bubble app's domain
Best practices
- Never expose AWS Secret Access Keys in frontend code — use pre-signed URLs via a backend service
- Create a bucket-specific IAM policy with minimal permissions
- Set CORS on your S3 bucket to allow requests from your Bubble domain
- Use pre-signed URLs with short expiration times (5-15 minutes) for security
- Organize files in S3 with a folder structure (e.g., /users/{user_id}/filename)
- Store the S3 file URL in your Bubble database for easy retrieval
Still stuck?
Copy one of these prompts to get a personalized, step-by-step explanation.
I want to integrate my Bubble.io app with Amazon S3 for file storage. I need to upload files from Bubble to S3, list files, and generate download links. Can you walk me through the IAM setup, Lambda function for pre-signing, and API Connector configuration?
Integrate Amazon S3 with my app for file storage. I need to upload files to S3 from a form, list files from a specific bucket folder, and provide download links. Set up the API Connector calls.
Frequently asked questions
Do I need a Lambda function for S3 integration?
It is strongly recommended. Lambda generates pre-signed URLs securely without exposing your AWS credentials. Alternatives include a Bubble plugin that handles signing or a third-party service.
How much does S3 storage cost?
S3 Standard storage costs about $0.023 per GB per month for the first 50TB. Data transfer out costs $0.09/GB after the first 100GB/month. Much cheaper than Bubble's native storage at scale.
Can I use S3 for hosting images displayed in my Bubble app?
Yes. Store image URLs from S3 in your Bubble database and use them as Image element sources. For public images, make the S3 bucket or specific objects publicly readable.
What about other AWS services like SES for email?
The same API Connector pattern works for any AWS service. For SES, create API calls to send emails. For Lambda, trigger functions. For DynamoDB, perform CRUD operations.
Is this faster than Bubble's built-in file storage?
S3 files served via CloudFront CDN can be faster than Bubble's native storage, especially for global users. The upload process involves an extra hop through Lambda for signing.
Can RapidDev help with complex AWS integrations?
Yes. RapidDev has extensive experience connecting Bubble to AWS services including S3, Lambda, SES, Cognito, and DynamoDB for enterprise applications.
Talk to an Expert
Our team has built 600+ apps. Get personalized help with your project.
Book a free consultation