Salesforce S3 File Upload is a reusable Lightning Web Component for uploading files from Salesforce directly to Amazon S3. It provides a familiar file-upload interface within Salesforce while allowing the actual file content to be stored outside of Salesforce.
The component combines Lightning Web Components, Apex, and Amazon S3 using presigned upload URLs. Salesforce coordinates the upload and retains information about the resulting file, while the browser transfers the file directly to S3. This separates file storage from the Salesforce application while keeping the upload process integrated into the Salesforce user experience.
The project was developed to provide a reusable approach that could be deployed across Salesforce applications and adapted to different record types and workflows rather than building a separate S3 integration for each use case.
Salesforce provides its own file storage, but there are situations where files need to be stored externally. Existing applications may already use Amazon S3 for document storage, organizations may want to avoid consuming Salesforce file storage, or uploaded files may need to participate in processes outside of Salesforce.
Simply adding an S3 upload to Salesforce also creates architectural questions. AWS credentials should not be exposed to the browser, large file content should not unnecessarily pass through Apex, and users should still have an upload experience that feels like part of Salesforce.
The goal was therefore not simply to transfer a file to S3, but to provide a secure and reusable bridge between Salesforce records and external file storage.
The application separates responsibility between Salesforce, the browser, and Amazon S3. The Lightning Web Component provides the user interface and coordinates the upload. Apex handles the server-side interaction necessary to authorize the request and generate the information needed for the S3 upload.
Once authorized, the browser communicates directly with Amazon S3 rather than sending the file through Apex:
This keeps Salesforce responsible for application logic and authorization while leaving file transfer and storage to the service designed for that purpose.
Uploads use temporary presigned URLs that allow the browser to send a specific file directly to Amazon S3. The user selects or drops a file within Salesforce, but the file itself does not need to travel through Apex before reaching S3.
This is particularly important because Apex has platform limits that make it a poor intermediary for transferring large binary files. Direct upload avoids unnecessary processing inside Salesforce and allows S3 to handle the actual file transfer. A similar architectural motivation, avoiding binary transfer through Apex because of platform limits, is documented in other Salesforce-to-S3 implementations as well.
The component provides upload progress and feedback within the Salesforce interface, so this separation is largely invisible to the user.
Although files are stored in S3, the upload process remains associated with Salesforce. The component can be placed on Salesforce record pages and uses the current record as context for the upload.
After an upload, Salesforce can retain the information needed to associate the externally stored file with the appropriate record. This provides the benefits of S3 storage without requiring users to leave Salesforce or independently manage files in AWS.
The separation also allows Salesforce to remain the system through which users initiate and manage the business process while S3 serves as the underlying file-storage service.
The integration is designed so AWS credentials do not need to be exposed to client-side JavaScript. Server-side Apex generates a temporary, narrowly scoped presigned URL that the browser can use to perform the upload.
Presigned URLs also limit how long the upload authorization remains useful. The repository's implementation uses short-lived upload URLs rather than providing the browser with persistent AWS access.
This does not replace normal Salesforce and AWS security controls. Access to the Lightning component, Apex classes, Salesforce records, IAM permissions, S3 bucket policies, and CORS configuration all remain part of the overall security model. The presigned-upload approach instead provides a controlled way to bridge those systems without giving the browser permanent AWS credentials.
The project was designed as a reusable Salesforce component rather than an upload workflow tied to a single application. The same underlying S3 connection and upload functionality can be incorporated into different Salesforce record pages and adapted to different business processes.
Separating the reusable connection and upload logic from project-specific behavior also makes it possible to extend the component when requirements change without rebuilding the underlying AWS integration. That became useful as the component evolved from its original use into additional Salesforce applications with different requirements.
This project also represents a different kind of work from the Django and Wagtail applications elsewhere in the portfolio. It required working across Salesforce's Lightning Web Component and Apex environment, browser-side JavaScript, and AWS infrastructure to create a single integrated workflow.