Your S3 buckets in one portal, in your own AWS account.
Cloud Certainty BucketDeck gives your teams one web portal for Amazon S3 across every AWS account you connect. They browse, preview, search and move data at scale; you decide who sees what, bucket by bucket, and every action is audited. It runs entirely in your AWS account, and no data leaves it.
ONE CLOUDFORMATION STACK · YOUR ACCOUNT · YOUR IDP · FROM $100 A MONTH
[ A ] FROM SUBSCRIPTION TO THE FIRST TRANSFER
- 01
Subscribe and deploy
Subscribe on AWS Marketplace, monthly or for 12 months, and launch one CloudFormation stack in your own account and Region. It is serverless and takes about ten minutes to create.
Stays in your account
Listings, previews, jobs, grants and the audit log stay in your AWS account, encrypted with a KMS key you control. Nothing is sent to Cloud Certainty.
Licensed through AWS
The licence is checked through AWS License Manager in your own account. Nothing phones home.
- 02
Sign in
Users sign in through Amazon Cognito with MFA or AWS IAM Identity Center on every plan, or through your own SAML or OIDC provider, such as Microsoft Entra ID or Okta, on Team and above.
Only trusted identities
Roles and grants follow the user’s email, so BucketDeck accepts only emails your directory asserts or has verified.
- 03
Connect your accounts
Buckets in this account are there from the start. Reach other accounts through a small IAM role you deploy in each, or across an AWS Organization with a StackSet, or with access keys if you allow them.
The role is the ceiling
BucketDeck can never do more in an account than the role you deployed there allows, and the role trusts only your stack, with an external ID.
- 04
Grant access and work
Give users and groups read, write, delete, manage or share on a connection and its buckets. They browse, preview, search and run transfer jobs, or use their own AWS permissions, as in the console.
Scoped on every request
Each request runs with AWS credentials that last an hour at most, narrowed by a session policy to the user’s grants.
Every action traced
CloudTrail names the user on every S3 call, and the audit log records every change, job and share link.
Read the security overview for the detail a security review needs.
[ B ] WHAT YOUR USERS GET
One place for the data in all your buckets, without handing out AWS console access. Users see only the connections and buckets they are granted, and actions they may not take are greyed out with the reason.
- Explorer
- Buckets and folders as in a file manager: upload (large files in parallel parts), download, copy, move, rename, delete and new folders. Large folders load page by page and are cached.
- Previews
- Text, code, images, video, PDF, CSV, JSON and more, inside the portal. Office documents and ZIP contents on Team and above.
- Search
- Live search under any bucket or prefix, by name or key, with globs, regular expressions and filters.
- Transfer jobs
- Copy or move between folders, buckets and accounts. Large jobs run in parallel in the background, in your account, with dry runs, failure reports and retries.
- Job history
- Every job with its progress and counts. Download the failures as a report, or retry them as a new job.
- Own AWS access
- Users can browse with their own IAM user keys or IAM Identity Center permissions, exactly as in the AWS console.
- Any screen
- Works on phones and tablets as well as on the desktop.
- Source prod · raw/2024/
- Destination archive · exports/
- Rename rule Hive to path
- Overwrite If newer
- Parallel workers 200
[ C ] WHAT ADMINISTRATORS CONTROL
Connections
This account from the start; other accounts through a spoke role with an external ID; access keys only if you switch them on.
Grants
Per user and per group, per connection and bucket: read, write, delete, manage and share. Prefix-level grants on Team and above.
Admins and settings
An admins role for people or groups. Link lifetimes, preview limits, job concurrency and, on Business and above, an IP allowlist.
Audit log
Role, connection, grant and settings changes, jobs, uploads, deletes, renames and share links, with the actor and source IP.
Licence and plan
The About page shows the licence status from AWS License Manager, your plan, the AWS accounts in use and how to upgrade.
Encryption and links
BucketDeck’s own data is encrypted with a KMS key you control. Previews and downloads use presigned links that expire in minutes.
[ D ] PLANS AND PRICING
Contract pricing on AWS Marketplace: pay monthly, or for 12 months up front. Plans are not priced per user. Prices in US dollars, billed through your AWS bill.
Starter
For a small team working across a few AWS accounts.
- AWS accounts
- 3
- Objects per job
- 10,000
- Parallel workers per job
- 50
- Audit log kept
- 30 days
Team
Adds Office previews, rename rules, templates, share links and your own SAML or OIDC sign-in.
- AWS accounts
- 10
- Objects per job
- Unlimited
- Parallel workers per job
- 200
- Audit log kept
- 90 days
Business
Adds bulk storage-class and restore jobs, Bucket Lens analytics and the IP allowlist.
- AWS accounts
- 50
- Objects per job
- Unlimited
- Parallel workers per job
- 500
- Audit log kept
- 365 days
Enterprise
Everything in Business, with the highest limits.
- AWS accounts
- Unlimited
- Objects per job
- Unlimited
- Parallel workers per job
- 1,000
- Audit log kept
- 3,650 days
| Feature | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Per month | $100 | $250 | $1,000 | $2,500 |
| 12 months | $1,000 | $2,500 | $10,000 | $25,000 |
| AWS accounts | 3 | 10 | 50 | Unlimited |
| Objects per job | 10,000 | Unlimited | Unlimited | Unlimited |
| Parallel workers per job | 50 | 200 | 500 | 1,000 |
| Audit log kept | 30 days | 90 days | 365 days | 3,650 days |
| Office and ZIP previews | Not included | Included | Included | Included |
| Rename rules: transform keys while copying | Not included | Included | Included | Included |
| Job templates | Not included | Included | Included | Included |
| Share links that last longer than presigned links | Not included | Included | Included | Included |
| Prefix-level grants | Not included | Included | Included | Included |
| SAML and OIDC identity providers | Not included | Included | Included | Included |
| Bulk storage-class change, restore from Glacier and ZIP download jobs | Not included | Not included | Included | Included |
| Bucket Lens (bucket analytics) and index search | Not included | Not included | Included | Included |
| IP allowlist | Not included | Not included | Included | Included |
Every plan includes
- Explorer: upload (multipart for large files), download, copy, move, rename, delete, new folders
- Previews of text, code, images, CSV, JSON and more
- Live search
- Copy and move jobs between folders, buckets and accounts, run in parallel in the background
- Job history
- Connections: this account, other accounts through a cross-account role, and optionally access keys
- Personal AWS access with users’ own IAM user keys or IAM Identity Center permissions
- Per-user and per-group grants: read, write, delete, manage, share
- Audit log, admins role, settings, and licence status on the About page
- Amazon Cognito sign-in with MFA, and IAM Identity Center
- Works on phones and tablets
Business and Enterprise are add-ons
On the BucketDeck listing, Team is the base plan. Business is Team plus the Business add-on ($750 a month or $7,500 for 12 months), and Enterprise adds the Enterprise add-on to both ($1,500 a month or $15,000 for 12 months). Choose all of them in the contract: an add-on on its own grants nothing. Starter is a separate listing, BucketDeck Starter.
AWS infrastructure is billed by AWS
Lambda, Step Functions, DynamoDB, S3 requests and data transfer run in your account and are billed by AWS as usual. The stack is serverless, so it costs close to nothing while nobody is using it.
Upgrade without reinstalling
From Starter, the upgrade page(opens in a new tab) prepares an AWS Marketplace private offer that credits the unused Starter term. Accept it and update the stack with the BucketDeck template; data and settings stay. Between BucketDeck plans, the offer credits your current contract, and BucketDeck keeps working while you switch, for up to 72 hours. How upgrades work.
Support
Basic support is included. Paid plans with response times, and a fixed-price installation service, are on the support page. Questions about plans: [email protected].
Amazon Web Services, AWS, Amazon S3 and AWS Marketplace are trademarks of Amazon.com, Inc. or its affiliates. Cloud Certainty BucketDeck is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.