Amazon Simple Storage Service
Self-Hosted Only
Amazon Simple Storage Service (S3) is a cloud-based storage solution that Liferay DXP’s S3 Store uses to keep Documents and Media files in the cloud. Once you’ve got an AWS account and an S3 bucket, configure the S3 Store to point DXP at it.
The S3 Store uses AWS SDK for Java 2.x.
Liferay DXP 2026.Q1 migrated the S3 Store from AWS SDK for Java 1.x to 2.x. Several configuration fields shown on the S3 Store screen no longer apply to AWS S3 and NTLM proxy authentication is no longer supported. See Settings That Do Not Apply to AWS S3 and Upgrading from AWS SDK for Java 1.x. For the full list of behavior changes, see Liferay DXP 2026.Q1 Breaking Changes.
Creating a Bucket
S3 organizes objects into buckets. In the AWS console, create a bucket for your DXP files. Place the bucket in a geographical region close to your DXP server.
When you create an AWS account, Amazon issues you unique access keys linked to your account. You’ll use those keys to configure the S3 Store.
Configuring the Store
-
Set this property in
portal-ext.properties:dl.store.impl=com.liferay.portal.store.s3.S3Store -
Restart DXP.
-
In the Control Panel, go to Configuration → System Settings → File Storage.
-
On the S3 Store screen, set these fields:
- Bucket Name: Your bucket’s name.
- Access Key: Your AWS access key. If left empty (along with Secret Key), the S3 Store uses the AWS default credentials provider chain to resolve credentials from the environment, an instance profile, or other standard locations.
- Secret Key: Your AWS secret key.
- S3 Region: Your bucket’s geographic region. The default is
us-east-1.
-
Leave the remaining fields at their defaults unless you need to customize a timeout, retry, multipart, proxy, endpoint, or storage class setting. Several fields on the screen are inert for AWS S3 — see Settings That Do Not Apply to AWS S3.
-
Click Save.
DXP is now using the Amazon S3 Store. To use the store across a cluster, ensure every node shares identical portal-ext.properties and System Settings configuration.
Using an S3-Compatible Endpoint
To target an S3-compatible service other than AWS S3 (for example, MinIO or LocalStack), set S3 Endpoint to the service URL. The value must include the scheme (http:// or https://); for example, https://s3.amazonaws.com. The scheme determines the transport protocol, and the SDK rejects values without one.
Proxy Support
To route S3 traffic through an HTTP proxy, set Proxy Host, Proxy Port, and (if the proxy requires authentication) Proxy Auth Type, Proxy Username, and Proxy Password on the S3 Store screen. Only the none and username-password proxy authentication types apply to AWS S3.
NTLM proxy authentication is not supported. To traverse an NTLM proxy, either use a downstream proxy that handles NTLM or switch the proxy itself to username/password authentication.
If you’re upgrading from a release that used AWS SDK for Java 1.x and your S3 Store configuration carries proxyAuthType=ntlm, the AWS S3 Store silently treats the proxy as unauthenticated. Change the value to username-password (or none) and verify that S3 traffic still reaches your proxy.
Settings That Do Not Apply to AWS S3
The S3 Store screen and the S3StoreConfiguration OSGi configuration are shared between AWS S3 and IBM Cloud Object Storage. These settings apply only to IBM Cloud Object Storage and are ignored by the AWS S3 Store:
| Setting | Notes |
|---|---|
| Connection Protocol | The transport protocol is determined by the S3 Endpoint value’s scheme. To force HTTP or HTTPS, set the scheme in S3 Endpoint. |
| Signer Override | AWS SDK for Java 2.x selects the appropriate signer (SigV4) automatically. |
| NTLM Proxy Domain | NTLM proxy authentication is not supported. |
| NTLM Proxy Workstation | NTLM proxy authentication is not supported. |
Upgrading from AWS SDK for Java 1.x
Liferay DXP 2025.Q4 and earlier
Before 2026.Q1, the S3 Store used AWS SDK for Java 1.x and the fields listed in Settings That Do Not Apply to AWS S3 were active. If you’re upgrading from 2025.Q4 or earlier, review your existing S3 Store configuration against these changes:
- NTLM proxy authentication (
proxyAuthType=ntlm,ntlmProxyDomain,ntlmProxyWorkstation) no longer applies to AWS S3. Switch to username/password authentication, route through a downstream proxy that handles NTLM, or use a different proxy. - Custom signer override (
signerOverride) no longer applies. Verify any S3-compatible target you connect to against the AWS SDK for Java 2.x default signer (SigV4) before upgrading. - Explicit connection protocol (
connectionProtocol) no longer applies. If you previously forced HTTP or HTTPS through this field, set the scheme in the S3 Endpoint value instead (see Using an S3-Compatible Endpoint).
For the canonical list of behavior changes shipping with the SDK upgrade, see Liferay DXP 2026.Q1 Breaking Changes.
Database Rollback Limitation
If a database transaction rollback occurs in a Document Library, the transaction’s file system changes are not reversed. Inconsistencies between Document Library files and those in the file system store can occur and may require manual synchronization. All DXP stores except DBStore are vulnerable to this limitation.