Frequently asked questions

#What is BucketDeck?

A web portal for Amazon S3 that runs entirely in your own AWS account. Your users browse, preview, search and move data across buckets and AWS accounts, with per-user grants and an audit log. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing

#How much does it cost?

BucketDeck is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front.

Prices are in US dollars and billed through your AWS bill. Plans are not priced per user.

#Why do Business and Enterprise appear as add-ons?

On the BucketDeck listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it is in the contract too, so an add-on bought on its own grants nothing.

#What else do I pay for?

The AWS resources the stack uses in your account (AWS Lambda, Step Functions, DynamoDB, S3 requests and data transfer, and so on) are billed to your account by AWS as usual. The stack is serverless, so it costs close to nothing while nobody is using it.

#What happens when the contract ends?

BucketDeck locks within an hour: only the licence page works. All data stays in your account, and subscribing again unlocks it.

#Plans

#What does each plan include?

Every plan has the explorer (upload, download, copy, move, rename, delete, new folders), previews, live search, copy, move and delete jobs, job history, connections to other accounts, personal AWS access, per-user and per-group grants, the audit log, Amazon Cognito sign-in with MFA, and IAM Identity Center sign-in.

• Team adds Office and ZIP previews, rename rules (transform keys while copying), job templates, share links, prefix-level grants, and SAML and OIDC identity providers.
• Business adds bulk storage-class change, restore from Glacier and ZIP download jobs, Bucket Lens (bucket analytics) and index search, and the IP allowlist.
• Enterprise has the Business features with the highest limits.

See the admin guide for how accounts are counted.

#How are AWS accounts counted?

Each connection counts its account, the stack's own account included, plus every account people reached with their own AWS sign-in in the last 30 days. When all are in use, new accounts can't be connected; accounts already in use keep working.

#Deployment

#Which AWS Regions are supported?

Any Region with AWS Lambda, Step Functions (Distributed Map), Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-central-1 and ap-southeast-2. The same template URL works in every Region. The Region you deploy to doesn't limit which Regions' buckets you can browse.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. See Getting started and the installation guide.

#Does anything run in my VPC?

Only a one-off installer task, for about a minute at install and at each upgrade. It needs outbound HTTPS. Nothing accepts inbound connections, and the rest of the stack is serverless.

#Can it reach buckets in other AWS accounts?

Yes. Deploy the spoke role template in each account, or across an AWS Organization with a StackSet. BucketDeck assumes that role with an external ID, and the role is the upper limit of what it can do there. Access keys are also possible, if you turn them on. See Deploy the spoke role in other accounts.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Data and security

#Does any data leave my account?

No. Everything BucketDeck stores (connections, grants, listings, job reports and the audit log) stays in your account, encrypted with a KMS key you control, and transfers run inside your accounts. Cloud Certainty runs no service in the data path, and the stack never contacts us. The licence check is a read from AWS License Manager in your own account. See the security overview.

#Can users only see what they are granted?

Yes. Users see nothing until an administrator grants them access to a connection, bucket or (on Team and above) prefix. Each request runs with short-lived AWS credentials limited to the user's grants, and CloudTrail records the user's email on every S3 call.

#Can users work with their own AWS permissions?

Yes, if you turn it on. Users connect their IAM Identity Center session or sign in with their IAM user keys, and AWS IAM decides what they can do, exactly as in the AWS console. See personal AWS access.

#Upgrades

#How do I install a new release?

Each release is a new template. Update the stack with the new template URL and keep your parameter values; running jobs keep running. See the upgrading guide and the release notes.

#How do I move from Starter to a BucketDeck plan?

In Administration → About, choose the plan under Upgrade to. The upgrade page prepares an AWS Marketplace offer that credits what is left of your Starter subscription. Accept it, then update the stack with the BucketDeck template. Your data and settings stay as they are. See From Starter to BucketDeck.

#How do I move between Team, Business and Enterprise?

Choose the plan the same way. The offer credits what is left of your current contract. In the AWS Marketplace console, first approve the cancellation of your current agreement, then accept the offer. BucketDeck keeps working on your current plan in between, for up to 72 hours, and no stack update is needed. See Between BucketDeck plans.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. Paid support plans with response times, and a fixed-price installation service, are on the support page.

#Does it work on phones and tablets?

Yes. The portal works on phones and tablets as well as on desktop browsers.