Skip to main content
Amazon S3 is a cloud object storage service. It lets your Lovable app read and write data files such as CSV, JSON, Parquet, and more directly in your S3 buckets, so you can build apps that work with external datasets, batch exports, file uploads, and file-based data sources. With AWS S3, your app can:
  • Read CSV, JSON, and other data files from S3 buckets
  • Upload files to S3 buckets (when write access is enabled)
  • List and browse objects in a bucket with prefix filtering
  • Integrate external data sources into your Lovable app
  • Access batch data exports from enterprise data pipelines
AWS S3 is a good fit when your app needs to read or write files in S3, such as analytics exports, data pipeline outputs, user uploads, or shared datasets.

​
Common use cases and example apps

​
How AWS S3 connections work

Each AWS S3 connection is tied to a single S3 bucket. When you connect AWS S3, you provide IAM credentials with access to that bucket. By default, connections are read-only, but you can enable read-write access to allow file uploads. Within your Lovable workspace:
  • You can create multiple AWS S3 connections.
  • Each connection targets a specific bucket and AWS region.
  • Each connection uses its own IAM credentials.
  • Multiple projects within a single workspace can use the same connection.
This makes it easy to connect different buckets (for example, production data and staging data) or separate access by team. AWS S3 uses Lovable’s gateway architecture for secure credential handling and automatic request signing. See Gateway-based connectors for details on authentication and usage limits.
By default, each AWS S3 connection has read-only access. To enable file uploads, set the Access type to Read & write when creating or editing the connection. Even with write access enabled, the connector does not support deleting objects.

​
How to connect AWS S3

Workspace admins and owners can connect AWS S3. When a connection is created, the S3 bucket becomes available across all projects in the workspace.

​
Prerequisites

Before connecting AWS S3, make sure you have:
  • An AWS account with access to the S3 bucket you want to connect
  • An IAM user with the appropriate S3 permissions (see below)
  • The bucket name and AWS region
  • Lovable workspace admin or owner role

​
Step 1: Create an IAM user with S3 access

Before setting up the connection in Lovable, create an IAM user in AWS with the minimum permissions needed.
1

Open the AWS IAM console

Go to the AWS IAM console and create a new IAM user, or use an existing one, for Lovable to use.
2

Attach an S3 policy

Create and attach an inline policy, or managed policy, with the following permissions. Replace YOUR-BUCKET-NAME with your actual bucket name.For read-only access:
For read and write access (includes upload):
Keep the policy scoped to only the bucket you want to connect. Avoid using wildcard (*) resources.
3

Generate access keys

In the IAM user’s Security credentials tab, create an access key. Save both the Access Key ID and Secret Access Key, since you’ll need them in the next step.
The secret access key is shown only once. Store it securely. If you lose it, you’ll need to create a new access key pair.

​
Step 2: Connect AWS S3 to Lovable

When you connect AWS S3, the bucket’s contents will be accessible to all users in your workspace.
1

Navigate to the AWS S3 connector

Open Connectors → App connectors and select AWS S3.
2

Add a new connection

Click Add connection.
3

Name the connection

In Display name, enter a name for the connection, for example S3 (Production Data).
4

Configure the connection

Fill in the required fields:
  • Bucket name: the name of the S3 bucket (for example, my-data-bucket)
  • AWS region: the region where the bucket is located (for example, us-east-1)
  • Access key ID: the IAM access key ID from the previous step
  • Secret access key: the IAM secret access key from the previous step
Optionally, expand Advanced settings to configure:
  • Access type: choose Read only (default) or Read & write. Read & write enables file uploads via signed URLs. Make sure the IAM policy includes s3:PutObject if you enable this.
5

Connect

Click Connect. Lovable verifies the credentials by checking access to the bucket. If verification succeeds, the connection is ready to use.
When connected, your Lovable apps can start reading data from the S3 bucket.

​
CORS configuration for signed URLs

File downloads and uploads use signed URLs, where the browser accesses S3 directly. For this to work, your S3 bucket must have a CORS (Cross-Origin Resource Sharing) policy that allows requests from your app’s origin. Without it, the browser will block the request. To configure CORS on your bucket:
  1. Open the S3 console and select your bucket.
  2. Go to Permissions → Cross-origin resource sharing (CORS).
  3. Add a CORS configuration. Replace https://your-app-id.lovable.app with your app’s actual URL:
If you only need downloads, you can restrict AllowedMethods to ["GET"]. Add "PUT" only if you have write access enabled. You can find your app’s origin URL in the browser address bar when previewing your Lovable app.
Avoid using "*" for AllowedOrigins in production. Restrict it to your app’s specific origin to follow the principle of least privilege.

​
Limitations

The AWS S3 connector does not support:
  • Deleting objects in the bucket
  • Connecting to S3-compatible services other than AWS S3, such as MinIO or DigitalOcean Spaces
  • Per-user AWS login where each end user connects their own AWS account
  • Real-time event notifications or S3 event triggers
Editors and above can remove specific projects from a connection without deleting the connection entirely. The connection will remain available for other projects. To unlink projects:
1

Open Connectors

Open Connectors, then go to App connectors, and select .
2

Open the connection

Open the connection you want to manage.
3

Select projects

Under Linked projects, check the projects you want to unlink.
4

Confirm

Click Unlink projects and confirm.
When unlinked, those projects will no longer have access to through this connection. If a project needs again, you can link it to any available connection.

​
How to delete a connection

Workspace admins and owners can delete connections. Other members can delete a connection if they created it, or if they have been explicitly granted access to it.
Deleting a connection is permanent and cannot be undone. It will remove the credentials from all linked projects, and any apps using this connection will stop working until a new connection is added.
Before deleting, review the Linked projects section to see which projects are currently using the connection. To delete a connection:
1

Open Connectors

Open Connectors, then go to App connectors, and select .
2

Open the connection

Open the connection you want to remove.
3

Review linked projects

Review the Linked projects section.
4

Delete

Under Delete this connection, click Delete and confirm.