Amazon S3 Officially Launches on the Vercel Marketplace

Vercel and AWS are deepening their integration once again. Amazon S3 is now available as an official integration on the Vercel Marketplace, letting developers create, connect, and manage S3 resources directly without leaving the Vercel project dashboard.

What the Integration Does

This integration automatically writes S3 connection details into environment variables, displays resources alongside your application infrastructure, and preserves an entry point to jump into the AWS Console for deeper configuration. In other words, day-to-day object storage operations stay in Vercel, while complex policies still go back to AWS.

Authentication is a key change: the integration uses short-lived credentials issued via OIDC, eliminating the need to put static AWS keys in environment variables. For frontend teams that have long struggled with key rotation and leak risks, this matters more than the UI consolidation.

OIDC (OpenID Connect) is an identity authentication protocol built on top of OAuth 2.0. It issues an additional signed ID Token during the authorization flow to prove the caller's identity. Using it to exchange for temporary cloud resource credentials has become a mainstream approach in recent years to replace static Access Keys.

Specifically in the Vercel-AWS integration, Vercel acts as the Identity Provider (IdP), issuing short-lived tokens with claims for project, environment, and more. On the AWS side, a pre-configured IAM role trust policy validates the token, then uses the STS AssumeRoleWithWebIdentity API to exchange it for temporary credentials that typically last only tens of minutes. This means that even if credentials are intercepted, the attack window is very limited, and no manual rotation is needed. By contrast, long-lived static AWS keys written into environment variables or committed to a repository can remain valid indefinitely, are hard to audit, and often require manual deactivation and recreation after a leak.

How to Use It in Code

The integration offers two integration paths. The simplest way is to import createS3 from @vercel/aws and get an S3 client already authenticated through Vercel OIDC in one line:

import { createS3 } from '@vercel/aws';
const os = createS3();

If you need finer-grained control, you can directly combine the AWS SDK with Vercel's OIDC credentials provider:

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { awsCredentialsProvider } from "@vercel/functions/oidc";

const s3 = new S3Client({
  region: process.env.AWS_REGION,
  credentials: awsCredentialsProvider({
    roleArn: process.env.AWS_ROLE_ARN,
  }),
});

Credentials, region, role ARN, and bucket name are all injected through environment variables, and the upload logic itself is no different from regular S3 usage.

Role ARN (Amazon Resource Name) is a string format in AWS used to uniquely identify resources, in the form arn:aws:iam::123456789012:role/my-role, containing fields such as partition, service, account ID, and resource path. In the OIDC authentication flow, roleArn points to the trusted IAM role, not to a user or key.

When the code calls awsCredentialsProvider, the SDK first requests a token from Vercel's OIDC endpoint, then carries that token to call AWS STS AssumeRoleWithWebIdentity to exchange for a set of temporary credentials with an expiration time. The roleArn must strictly match the conditions in the role trust policy on the AWS side (such as allowed OIDC issuer, audience, and project identifier), otherwise the exchange will fail. This is also why the integration can complete configuration automatically: it writes the role, region, and bucket name into environment variables together, ensuring the trust relationship on both ends stays consistent.

S3, Blob, or More Specialized Storage

Vercel also offers Blob storage, positioned as public/private storage for application file uploads, with built-in caching and CDN distribution close to end users. The official selection guidance is quite restrained:

• Teams with existing AWS workflows should choose the Amazon S3 integration;
• For analytics on managed Iceberg tables, use S3 Tables;
• For vector storage and retrieval, use S3 Vectors.

This essentially breaks the decision of "where to put files" into three more specific questions: general-purpose object storage, analytical table format, and vector retrieval. Blob continues to handle latency-sensitive static assets served via CDN.

v0 and How to Get Started

S3 is also integrated with v0, allowing you to configure resources, establish connections, and generate code directly from prompts, skipping the manual steps of creating buckets and configuring roles.

The entry point for activation is on the Vercel Marketplace. Creating a new AWS account through Vercel grants $100 in credits valid for six months; existing accounts can also be linked and their plans and usage managed in the Vercel dashboard. Note that linked existing accounts only support buckets newly created through Vercel—pre-existing buckets are not covered by management.

A Quick Take

The core of this integration isn't "opening one fewer tab"—it's that OIDC short-lived credentials completely remove AWS keys from the Vercel project's environment variables. For small and mid-sized teams, this eliminates a long-standing operational risk; for larger teams with mature AWS governance, the value is more about developer experience and resource visibility. The limitation is also clear—pre-existing buckets cannot be managed, indicating that this integration still leans toward a "create new in Vercel" workflow rather than taking over all AWS assets.

The inability to manage pre-existing buckets is a common boundary for managed integrations like this. The reason is that the integration relies on the IAM role trust relationship and resource naming conventions established synchronously when resources are created on the Vercel side. Existing buckets are often attached to different accounts, policies, or organizational units and require additional explicit authorization to be brought under unified management. If you want to connect existing buckets, you typically still need to manually adjust bucket policies and role permissions in the AWS Console, then explicitly pass the bucket name and role ARN through environment variables—you can't fully rely on automatic configuration. This also explains why the official positioning is as a smooth path for "creating new in Vercel" rather than a unified control plane for all AWS assets.

One-line Summary

Amazon S3 joins the Vercel Marketplace as an official integration, replacing static keys with OIDC short-lived credentials.

Paragraph Summary

Amazon S3 is now an official integration on the Vercel Marketplace, letting developers create, connect, and manage S3 resources directly within the Vercel project dashboard. Connection details are automatically written to environment variables, while an entry point to the AWS Console remains for deeper configuration. The most critical change is authentication: the integration uses short-lived credentials issued by Vercel OIDC instead of static AWS keys in environment variables, reducing key rotation and leak risks. At the code level, it offers a one-line createS3 client and a fine-grained option combining the AWS SDK with awsCredentialsProvider. The article also compares S3, Blob, S3 Tables, and S3 Vectors, and explains that resources can be configured via v0, new accounts can receive credits, but pre-existing buckets in existing accounts are not covered by management.