--- title: "Strapi With Wasabi" slug: "strapi-with-wasabi-1" updated: 2026-07-16T21:12:25Z published: 2026-07-16T21:12:25Z canonical: "docs.wasabi.com/strapi-with-wasabi-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.wasabi.com/llms.txt > Use this file to discover all available pages before exploring further. # Strapi With Wasabi This article covers configuring [Strapi's](https://strapi.io/) [Upload plugin](https://docs.strapi.io/cms/features/media-library) to use Wasabi as an S3-compatible storage provider, resolving the Content Security Policy restrictions that block media previews in the Strapi admin panel, and locking down Wasabi access using scoped IAM policies and bucket policies. > [!WARNING] > **Be aware of and follow Wasabi's** [**Free** **Egress** **Policy**](https://wasabi.com/paygo-pricing-faq/#free-egress-policy) **when storing and downloading objects.** ## Requirements - Node.js — version used during testing: v26.4.0 - npm — version used during testing: 11.17.0 - Strapi — version used during testing: 5.50.0 - @strapi/provider-upload-aws-s3 — version used during testing: 5.50.0 - An active Wasabi account. See [Signing Up for Wasabi](https://docs.wasabi.com/docs/signing-up-for-wasabi) for instructions on how to sign up. - A Wasabi bucket. See [Creating a Bucket](https://docs.wasabi.com/docs/working-with-buckets-and-objects#creating-a-bucket) for details. - [Wasabi Console](https://console.wasabisys.com) access. ## Creating a Wasabi Policy Before creating the Wasabi user Strapi will authenticate as, create a scoped policy limiting access to only the actions and bucket Strapi actually needs: reading, writing, listing, and deleting objects in a single named bucket. To create the policy in the Wasabi Console, see [Creating a Policy](https://docs.wasabi.com/docs/creating-a-policy) for details: 1. Login to the [Wasabi Console](https://console.wasabisys.com). 2. In the left-hand menu, click **Policies**, then click **Create Policy**. 3. Enter a policy name (for example, **StrapiPolicy**). Paste the JSON policy below into the policy editor. Adjust the S3 actions as needed for your organization. Replace YOUR_WASABI_BUCKET with the name of your Wasabi bucket. Click **Create Policy** to save it. ```json {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:GetObject",        "s3:PutObject",        "s3:ListBucket",        "s3:DeleteObject"      ],      "Resource": [        "arn:aws:s3:::YOUR_WASABI_BUCKET",        "arn:aws:s3:::YOUR_WASABI_BUCKET/*"      ]    }  ] } ``` ## Creating a Wasabi User Rather than using Wasabi root account keys in .env, a dedicated Wasabi user with programmatic-only access should be created and restricted using the policy created above. The resulting access key and secret key are what get placed into .env in the [Configuration Changes](/v1/docs/clone-strapi-with-wasabi#configuration-changes) section below. To create the user in the Wasabi console, see [Creating a User Account and Access Key](https://docs.wasabi.com/docs/creating-a-user-account-and-access-key). 1. In the left-hand menu, click **Users**, then click **Create User**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-krwp.png) 2. Enter a username and select **Programmatic access only** (create API keys). Click **Next**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-kslg.png) 3. Adding the user to a group is not required. Click **Next**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-ktir.png) 4. Under attached policies, search for and select the policy created above, scroll down, then click **Next**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-ktwc.png) ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-kuab.png) 5. Review the summary and click **Create User**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-kuei(1).png) 6. On the confirmation screen, copy or download the Access Key and Secret Key immediately — the secret key is only displayed once. These become the WASABI_ACCESS_KEY and WASABI_SECRET_KEY values in .env, used in the next section. Store the keys in a secure location. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-kulg.png) 7. After downloading the keys, click the “X” to exit. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-kuqe.png) 8. Click **Close**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-kutk.png) ## Configuration Changes Three files in the Strapi project were modified to connect the Upload plugin to Wasabi and allow the admin panel to render images stored there. ### config/plugins.ts The upload plugin's provider was set to the AWS S3 provider (Wasabi is S3-compatible), pointed at the Wasabi endpoint and bucket instead of AWS. Credentials, endpoint, region, and bucket name are pulled from environment variables rather than hard-coded. > [!NOTE] > This configuration example discusses the use of Wasabi's us-east-2 storage region. To use another Wasabi storage region, use the appropriate URL in [Service URLs for Wasabi's Storage Regions](https://docs.wasabi.com/docs/service-urls-for-wasabis-storage-regions). Use the URL for the region your bucket is located in. ```typescript upload: {  config: {    provider: '@strapi/provider-upload-aws-s3',    providerOptions: {      s3Options: {        credentials: {          accessKeyId: env('WASABI_ACCESS_KEY'),          secretAccessKey: env('WASABI_SECRET_KEY'),        },        endpoint: env('WASABI_ENDPOINT', 'https://s3.us-east-2.wasabisys.com'),        region: env('WASABI_REGION', 'us-east-2'),        params: {          Bucket: env('WASABI_BUCKET'),        },      },    },    security: {      allowedTypes: allowedMediaTypes,      deniedTypes: deniedExecutableTypes,    },  }, }, ``` ### .env The access key and secret key for the scoped Wasabi user created in the previous section are added here, along with the endpoint, region, and bucket name, so credentials are never hard-coded into source files. Replace your_access_key and your_secret_key with the previously created access and secret keys. Use the appropriate endpoint URL and region for your bucket. Replace your_bucket_name with the name of your Wasabi bucket. ```plaintext WASABI_ACCESS_KEY=your_access_key WASABI_SECRET_KEY=your_secret_key WASABI_ENDPOINT=https://s3.us-east-2.wasabisys.com WASABI_REGION=us-east-2 WASABI_BUCKET=your_bucket_name ``` ### config/middlewares.ts Strapi's default Content Security Policy only allows images to load from strapi.io's marketplace domain, so uploaded thumbnails fail to render in the admin Media Library even though the upload itself succeeded. The strapi::security middleware was converted from a plain string into a configured object so the img-src and media-src directives could be extended to include the Wasabi host. The host is prefixed with https:// so only secure requests are permitted. Replace “us-east-2” with the region for your bucket. ```typescript export default ({ env }) => {  const wasabiHost = `https://${env('WASABI_BUCKET')}.s3.${env('WASABI_REGION', 'us-east-2')}.wasabisys.com`;  return [    'strapi::logger',    'strapi::errors',    {      name: 'strapi::security',      config: {        contentSecurityPolicy: {          useDefaults: true,          directives: {            'img-src': ["'self'", 'data:', 'blob:', wasabiHost, 'market-assets.strapi.io'],            'media-src': ["'self'", 'data:', 'blob:', wasabiHost, 'market-assets.strapi.io'],            upgradeInsecureRequests: null,          },        },      },    },    'strapi::cors',    'strapi::poweredBy',    'strapi::query',    'strapi::body',    'strapi::session',    'strapi::favicon',    'strapi::public',  ]; }; ``` ## Restricting Access by IP Address Where enabling full public access is undesirable or unavailable, a bucket policy can instead deny anonymous access to everyone except a specific IP address or range. This keeps the bucket private to the public at large while still allowing direct object reads from a known, trusted location (such as an office or a developer's current IP). Refer to [Defining a Bucket Policy for Public Access — Restricted Access for Specific IP Addresses](https://docs.wasabi.com/docs/defining-a-bucket-policy-for-public-access#restricted-access-for-specific-ip-addresses) for more information. > [!NOTE] > Alternatively, full public access can be allowed - see the next section, [Enabling Public Read Access to the Bucket](/v1/docs/clone-strapi-with-wasabi#enabling-public-read-access-to-the-bucket). To apply this policy in the Wasabi console: 1. Login to the [Wasabi Console](https://console.wasabisys.com). 2. From the **Buckets** list, click the bucket name. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-jvnp.png) 3. Click the Settings gearwheel. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-jyag.png) 4. Click the **Permissions** tab. Click **Edit** next to Bucket Policy. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-jzij.png) 5. Paste the policy below into the editor. Replace YOUR_IP_ADDRESS with your own public IP address and YOUR_WASABI_BUCKET with the name of your bucket before saving this policy. This policy denies s3:GetObject to every principal except requests originating from that address. A CIDR range (such as /24) can be substituted for a /32 single address to allow a broader block of addresses. ```json {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Deny",      "Principal": {        "AWS": "*"      },      "Action": "s3:GetObject",      "Resource": "arn:aws:s3:::YOUR_WASABI_BUCKET/*",      "Condition": {        "NotIpAddress": {          "aws:SourceIp": "YOUR_IP_ADDRESS/32"        }      }    }  ] } ``` 1. Click **Save**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/strapi-with-wasabi-image-co83obxh.png) ## Enabling Public Read Access to the Bucket > [!NOTE] > This section is an alternative to the previous [Restricting Access by IP Address section](/v1/docs/clone-strapi-with-wasabi#restricting-access-by-ip-address). It is not required if the previous section was implemented. > [!NOTE] > Note: Public Access is not available by default on Wasabi trial accounts. If you have a trial account, it must be requested from Wasabi Support at support@wasabi.com before a public-read bucket policy will take effect. Uploading an object to Wasabi with valid credentials does not make that object readable by anonymous requests, such as a browser loading an image URL directly. By default, buckets are private, which causes image and thumbnail requests to fail with a 403 Forbidden error even though the upload itself succeeded. To allow the Strapi admin panel (and any public-facing site using the same media) to load images, the bucket needs a policy granting public s3:GetObject access, or Public Access needs to be enabled on the bucket. 1. Login to the [Wasabi Console](https://console.wasabisys.com). 2. Click **Buckets** then click the name of your bucket. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-jvnp.png) 3. Click the Settings gearwheel. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-jyag.png) 4. On the **Properties** tab, expand **Public Access Override**. Toggle the switch to the right to enable public access. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260708-lhez.png) 5. Enabling the toggle prompts a confirmation, since it grants read access to anyone on the internet who has an object's URL. Click **OK**. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260708-lgzj.png) 6. Once confirmed, the toggle switches on and a warning banner remains visible as a reminder that all objects are now read-only accessible to anyone with the URL. Note that this switch only applies to NEW objects added after it is enabled — existing objects still need their own permissions updated, or a bucket policy applied, to become publicly readable. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/strapi-with-wasabi-image-bylgq37q.png) 7. Public Access will show that it is enabled for the bucket in the list of buckets. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260708-hzde.png) ## Verifying the Upload in Strapi Before any files exist, the Media Library shows an empty state prompting for the first upload. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/strapi-with-wasabi-image-1sw4hpwr.png) After uploading a test image and correcting the CSP and bucket-permission issues described in this article, the thumbnail renders correctly in the Media Library grid. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/strapi-with-wasabi-image-vqq1hkr0.png) ## Reviewing Uploaded Objects in Wasabi Strapi's Upload provider generates multiple renditions of each image (thumbnail, small, medium, large, and the original) and pushes all of them to the bucket. These can be confirmed directly in the Wasabi console under the bucket's Objects list. 1. Login to the [Wasabi Console](https://console.wasabisys.com). 2. Click **Buckets**, then click the name of your bucket. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-jvnp.png) 3. The objects in your bucket will appear here. ![](https://cdn.document360.io/bef0a1ea-7768-4d5a-b520-c4fe2f7fafad/Images/Documentation/SCR-20260709-koiw.png)