Add support for STORAGE_S3_TOKEN #5010

New Issue

OVERLORD · 2026-02-05T09:33:30+03:00

OVERLORD commented

2026-02-05 09:33:30 +03:00

Originally created by @vlaborie on GitHub (Oct 16, 2024).

Describe the feature you'd like

Add support for defining STORAGE_S3_TOKEN in addition to STORAGE_S3_KEY and STORAGE_S3_SECRET for S3 storage.

Temporay S3 credentials generated by STS (Security Token Service) need to define credentials['token'] in addition to credentials['key'] and credentials['secret'].

See AWS SDK docs about this: https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_temporary.html#providing-temporary-credentials-to-the-sdk-php

Describe the benefits this would bring to existing BookStack users

This permit to use temporary and limited-privilege S3 credentials which increase security and permit some automation process.

Can the goal of this request already be achieved via other means?

No.

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

How long have you been using BookStack?

1 to 5 years

Additional context

I only use temporary and auto-generated credentials everywhere i can as a security principle.

Originally created by @vlaborie on GitHub (Oct 16, 2024). ### Describe the feature you'd like Add support for defining **STORAGE_S3_TOKEN** in addition to **STORAGE_S3_KEY** and **STORAGE_S3_SECRET** for S3 storage. Temporay S3 credentials generated by **STS** ([Security Token Service](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html)) need to define **credentials['token']** in addition to **credentials['key']** and **credentials['secret']**. See AWS SDK docs about this: https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_temporary.html#providing-temporary-credentials-to-the-sdk-php ### Describe the benefits this would bring to existing BookStack users This permit to use **temporary** and **limited-privilege** S3 credentials which increase security and permit some automation process. ### Can the goal of this request already be achieved via other means? No. ### Have you searched for an existing open/closed issue? - [X] I have searched for existing issues and none cover my fundamental request ### How long have you been using BookStack? 1 to 5 years ### Additional context I only use temporary and auto-generated credentials everywhere i can as a security principle.

OVERLORD added the 🔨 Feature Request label 2026-02-05 09:33:30 +03:00

OVERLORD commented

2026-02-05 09:33:33 +03:00

@ssddanbrown commented on GitHub (Oct 16, 2024):

Hi @vlaborie, thanks for the request.

Just so I understand, you'd be fetching the token externally then regularly be updating the token value for BookStack?

Just trying to understand the use and scenario, since I really don't want to expand the scope/support of these settings, especially where service specific and/or where not commonly needed or desired.

@ssddanbrown commented on GitHub (Oct 16, 2024): Hi @vlaborie, thanks for the request. Just so I understand, you'd be fetching the token externally then regularly be updating the token value for BookStack? Just trying to understand the use and scenario, since I really don't want to expand the scope/support of these settings, especially where service specific and/or where not commonly needed or desired.

OVERLORD commented

2026-02-05 09:33:34 +03:00

@vlaborie commented on GitHub (Oct 16, 2024):

Hi @ssddanbrown,

Yes that's what i do. This is very usefull because the fetching process is fully automated.

I just need to create an S3 bucket and an S3 policy and the credentials are automaticaly managed.

Should be noted that is not specific to AWS but common to multiple S3 providers (i use it with Minio).

@vlaborie commented on GitHub (Oct 16, 2024): Hi @ssddanbrown, Yes that's what i do. This is very usefull because the fetching process is fully automated. I just need to create an S3 bucket and an S3 policy and the credentials are automaticaly managed. Should be noted that is not specific to AWS but common to multiple S3 providers (i use it with Minio).

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5010