Most teams have the same S3 problem. The data people need is spread across buckets in several AWS accounts. The engineers can reach it through the console or the CLI. Everyone else, analysts, support staff, partners, asks an engineer, or gets an IAM user that can see far more than they need.
BucketDeck is a web portal for Amazon S3 across every AWS account you connect. People browse, preview, search and move data in a file manager. Access is granted per user and per group. Every action is audited. And it runs entirely in your own AWS account.
Runs in your account
BucketDeck is one serverless CloudFormation stack in your own account and Region. It takes about ten minutes to create.
- Nothing goes to us. Listings, previews, jobs, grants and the audit log stay in your account, encrypted with a KMS key you control. Cloud Certainty runs no service in the data path.
- Serverless. It uses Lambda, Step Functions, DynamoDB and S3, billed by AWS as usual, and costs close to nothing when nobody is using it.
- Licensed through AWS. You buy it on AWS Marketplace and the licence is checked through AWS License Manager in your account.
One portal, many accounts
Buckets in the account you deploy to are available straight away. Other accounts connect through a small IAM role in each, which you can roll out across an AWS Organization with a StackSet, or with access keys if you choose to allow them.
That role sets the ceiling. BucketDeck can never do more in an account than its role allows, and the role trusts only your stack, with an external ID.
Access per person
Admins grant access per user and per group, for each connection and bucket: read, write, delete, manage and share. On Team and above, grants can go down to a prefix.
Every request runs with AWS credentials that last an hour at most, narrowed by a session policy to exactly what that user's grants allow. Anything a user cannot do is greyed out, with the reason shown, rather than failing with an access denied error.
And CloudTrail names the user. Each session BucketDeck starts carries the user's email as its source identity, so the S3 calls in CloudTrail show who made them, not just a shared role.
Explorer, previews and search
- A file manager for S3: upload, with large files sent in parallel parts, download, copy, move, rename, delete and create folders. Large folders load page by page.
- Previews of text, code, images, video, PDF, CSV, JSON and more, with Office documents and ZIP contents on Team and above.
- Live search under any bucket or prefix, by name or key, with globs, regular expressions and filters. Business adds Bucket Lens analytics and index search.
Preview and download links expire within minutes.
Moving data
Copy or move folders between buckets and accounts as background jobs that run in your account, in parallel, so people can close the browser. Jobs support dry runs, failure reports and retries. Team adds rename rules and job templates. Business adds bulk storage-class changes, Glacier restores and ZIP downloads.
Audit
The audit log records role, connection, grant and settings changes, plus jobs, uploads, deletes, renames and share links, each with the actor and source IP. Retention runs from 30 days on Starter to ten years on Enterprise.
Plans
BucketDeck is priced per deployment, not per user, on AWS Marketplace:
- Starter, $100 a month: 3 AWS accounts, jobs of up to 10,000 objects.
- Team, $250 a month: 10 accounts, prefix-level grants, your own SAML or OIDC provider, share links, rename rules and job templates.
- Business, $1,000 a month: 50 accounts, Bucket Lens, storage-class and restore jobs, and an IP allowlist.
- Enterprise, $2,500 a month: unlimited accounts and ten years of audit retention.
Each plan is also available for 12 months up front, at ten times the monthly price. See plans and pricing (opens in a new tab) for the full comparison.
Get started
Find BucketDeck on AWS Marketplace (opens in a new tab), read the docs (opens in a new tab), or email [email protected] with a description of your accounts and we will help you plan the install.