Amazon S3 (and S3-Compatible Services)

npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner

disks: {
  s3: {
    driver: 's3',
    config: {
      bucket: 'my-bucket',
      region: 'us-east-1',
      credentials: { accessKeyId: '...', secretAccessKey: '...' },
    },
  },
},

S3-compatible services

MinIO, Backblaze B2, DigitalOcean Spaces, and Wasabi are all S3-API compatible — configure them the same way, pointing endpoint at that provider and, if required, setting supportsACL: false:

config: {
  bucket: 'my-bucket',
  region: 'us-east-1', // some providers require any non-empty string here
  endpoint: 'https://<provider-specific-endpoint>',
  credentials: { accessKeyId: '...', secretAccessKey: '...' },
  supportsACL: false, // if the provider doesn't support S3 ACL operations
},

CloudFront signed URLs

npm install @aws-sdk/cloudfront-signer

Pass a cdn block and set cdnUrl to the CloudFront distribution URL:

config: {
  bucket: 'my-bucket',
  region: 'us-east-1',
  credentials: { accessKeyId: '...', secretAccessKey: '...' },
  cdnUrl: 'https://cdn.example.com',
  cdn: {
    provider: 'cloudfront',
    signingKeyId: process.env.CLOUDFRONT_KEY_PAIR_ID,
    signingKey: process.env.CLOUDFRONT_PRIVATE_KEY,
  },
},

With this configured, storage.getSignedUrl(key) transparently signs through CloudFront instead of plain S3. Calling it without @aws-sdk/cloudfront-signer installed rejects with a clear "install it with..." error message rather than a cryptic module-not-found error.