Files and the CDN
Where an app's files live in S3, and the two paths that carry them to a browser: signed URLs and the edge cache.
An app's files live in S3, private by default, in the workspace's region, and reach a browser through one of two paths: signed URLs on a branded, cookieless domain for private files, and a global edge cache for public ones. This chapter covers the buckets, the file stores an app sees, how bytes get in and out, and what the edge does with them.
#The Buckets
Every region has a pair of buckets: a private bucket and a public one. The compute region's pair carries the base names; every other region's pair carries the region's slug as a suffix. A single Terraform module creates each regional pair with settings that mirror the base pair exactly.
| Private bucket | Public bucket | |
|---|---|---|
| Holds | App databases, git mirrors, build artifacts, diffs, private app files, workspace snapshots | Public app files, user uploads, web assets |
| Public access | Blocked at the bucket | Public read for the edge Workers |
| Encryption | Server-side, at rest | Server-side, at rest |
| Versioning | On; the newest prior versions are kept | On; prior versions expire after seven days so a deleted upload leaves storage |
| Transport | HTTPS only | HTTPS only |
| Access logs | On, to a same-region log bucket, date-partitioned for query | Not a PHI surface |
| Transfer acceleration | On, for client-direct uploads | On |
#File Stores
An app has named file stores, each either private or public. A method reads and writes them through the SDK: put, get, head, list, delete. Those calls hit the platform's brokered file routes with the execution's hook token, so only a backend method running in a sandbox can use them; a frontend never can. Keys are rooted under the app, the store and the region, and every persisted reference is self-describing, carrying its region and bucket so a read never re-derives them.
Large and browser-originated uploads use a client-direct grant: the platform mints a presigned POST for a specific key, size limit and content type, and the browser uploads to S3 directly over the accelerated endpoint. Bytes never pass through a platform pod. The object's arrival is what triggers scanning; see Content Inspection.
#Private Files
A private file is served through a CloudFront signed URL the app mints. One CloudFront distribution per region fronts that region's private bucket through Origin Access Control, so the bucket is readable by that distribution and nothing else. Distributions share one signing key group and one wildcard certificate, and serve on a branded files domain with the region in the host.
The files domain is a different site from the app domains. It is a cookieless origin, so a private file URL carries no app session and a file cannot read one. Per-user signed content is never cached.
A private image that a viewer wants resized goes through the app's own domain: the edge authorizes the request by forwarding the viewer's credentials to the platform, which answers with a short-lived signed URL, and the edge resizes from that. It is never edge-cached; the target is per-user and short-lived.
#Public Files
A public file is served on the app's own domain under a stable path derived from the app, store and key. The edge asks the platform where the object lives, receives a short-lived redirect it may reuse, fetches and optionally transforms the bytes, and caches the transformed result at the edge for a long time under a content-addressed CDN key. Because the URL is derived from the key, an overwrite reuses the URL and a delete leaves it pointing at an object that answers 404, which is never cached.
For files, images and video, the public CDN runs as Cloudflare Workers over the public buckets. Image transformation happens at the edge from an allow-listed set of source origins. Video is served with range support. A purge path lets the platform evict a key from the edge when it changes.
#Web Assets
A release's built web interface is uploaded to a per-release prefix and served through the app's origin with the caching split described in Edge and Custom Domains: session HTML is never cached, content-addressed assets are cached at the edge.