Laravel S3 Storage Patterns

Laravel's Flysystem S3 integration with support for public/private files and signed URLs.

When to Use

• Implementing file upload features
• Storing user-generated content (images, videos, documents)
• Managing public vs private file access
• Generating temporary download links
• Streaming large files
• Configuring S3 bucket security
• Direct browser uploads to S3

Storage Facade Quick Reference

Public vs Private Files

Public files are written with the 'public' ACL parameter and served via url(). Private files omit the visibility parameter (defaults to bucket policy) and are accessed via temporaryUrl() with a TTL — short TTLs (5 min) work well for authenticated downloads of short-lived links. See reference.md → Public vs Private Files for both upload + access flows.

File Validation Pattern

Pair $request->validate(['image' => 'required|image|mimes:jpeg,jpg,png|max:2048']) with the Storage::disk('s3')->put() call so MIME and size validation gate the upload. See reference.md → File Validation for the complete request/upload flow.

Document Upload Security Patterns

For uploaded-document use cases (KYC, legal docs), three security hardening patterns apply:

• 'visibility' => 'private' on the disk config — defense-in-depth; even a misconfigured bucket ACL or CDN origin won't produce public URLs because Laravel writes with private ACL.
• MIME-derived extension — build a server-side MIME_TO_EXT map keyed on the validated MIME type; never use getClientOriginalExtension() (attacker-controlled string).
• Signed URL accessor with production re-throw — try { temporaryUrl() } catch (RuntimeException $e) { ... } pattern; re-throw in production to prevent silent fallback to a public URL on misconfigured S3-compatible disks (r2, do_spaces).

See reference.md → "Document Upload Security" for code skeletons.

Anti-Patterns

See reference.md for configuration, CORS setup, streaming patterns, security hardening, and IAM policies. See examples.md for complete upload actions, bucket policies, anti-patterns, and real-world implementations.