AWS S3

Private object storage for candidate resumes.

Used for

• Presigned PUT so the browser uploads directly (no API proxy of file bytes)
• Presigned GET for download; server GetObject for parse pipeline

Auth (env vars)

• RESUME_BUCKET_NAME — target bucket
• AWS_REGION — S3 client region
• AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY — local dev only (both or neither)

In deployed environments, the task IAM role provides credentials; do not set access keys on Fargate.

Notes

• Staging keys under resume-uploads/…; permanent keys under resumes/{org}/{candidate}/….
• Upload presign TTL 15 minutes; download presign TTL 5 minutes.
• Bucket uses private access and HTTPS-only in infrastructure.