PD AWS S3 for Blesta

PD AWS S3 lets a hosting company sell Amazon S3 object storage as its own product in Blesta. Your customer orders a storage package, and a private bucket with its own access key is created in your AWS account within minutes. The customer manages it from your Blesta client portal, you set the price, AWS bills you at cost, and the difference is your margin.

It is built for hosts who want to offer S3-compatible storage for backups, websites and applications without handing out AWS logins, without writing scripts to create buckets, and without a support ticket every time a customer needs a new access key.

Why hosts choose PD AWS S3

Every customer is isolated by AWS itself. Each service gets its own bucket and its own dedicated IAM user whose policy covers that customer's buckets only. A customer's key cannot list other buckets in your account, create or delete buckets it does not own, or reach any other AWS service. Isolation is enforced by AWS, not by convention.

Orders set themselves up. Once the invoice is paid, Blesta provisions the service and the bucket and key are created in the region the customer chose. Cancelling a service terminates it, so storage follows payment without you touching it. A service you add to a client from their profile is provisioned the same way.

Fifteen AWS regions, chosen by the customer. Offer North America, Europe, Asia-Pacific and South America from one package. Every region offered is generally available and needs no opt-in in your AWS account.

Quotas you can sell in tiers. Storage is sold as quota tiers, one package option per tier. Usage is measured daily from AWS and shown to the customer against their quota, and you can see who is over in the admin panel.

Customers help themselves. Extra buckets, versioning, automatic clean-up rules, browser access (CORS), expiring share links and key rotation are all on the customer's own service page. That removes most of the tickets a storage product normally creates.

Nothing is deleted by accident. Termination revokes access at once, but files are kept for a window you set, from 7 to 90 days. Deleting them needs your approval, and an immediate purge needs the exact bucket name typed in.

How it works

1. Connect your AWS account. Under Settings, Company, Modules, add an AWS Account with its Access Key ID and Secret Access Key. We ship the exact policy to use. Test Connection checks S3, IAM and CloudWatch and names whichever permission is missing, without creating anything.
2. Create your packages. Add a package with this module and your account. One click on Generate options builds the Storage Quota, Max Buckets, Versioning and Region options, which you then price under Configurable Options.
3. Your customer orders. They pick a quota and a region and pay. The bucket and key are created, and their service page shows progress until the storage is ready, usually within a couple of minutes.
4. You get paid, they manage it. Blesta keeps billing as usual. Upgrades and downgrades go through Blesta's normal flow and keep the customer's data.

What you get in Blesta

Selling and pricing

• Package options generated in one click: Storage Quota from 10 GB to 5 TB or Unlimited, Max Buckets from 1 to 10, Versioning on or off, and Region
• Choose which options customers see; anything you hide is fixed to the package's default
• Soft quota mode (the default) warns but keeps uploads working; hard mode pauses uploads at 100% while downloads and deleting keep working, so the customer can free space themselves
• Customers are emailed at 80% and again at 100% of their quota, and you can copy those emails to your administrators
• Customer bucket names start with a prefix you choose, so your brand is on every bucket
• More than one AWS account, one account row per AWS account, so you can grow past a single account's IAM user limit

Provisioning you can trust

• Each service creates one IAM user with an inline policy scoped to that customer, and your AWS admin keys stay on your Blesta server
• If no AWS account is connected, an order is refused up front instead of leaving a half-made service
• A failed setup is never shown as done: the customer sees a plain message and the exact provider error is kept for you in the Activity tab
• Moving a customer to a smaller plan than they already use never deletes anything
• Nothing is installed on any customer server, and no daemon runs: the module talks to AWS over HTTPS

Running it day to day

• Clients & Storage lists every service with its client, state, access mode, quota percentage, usage and last measurement
• Set any service to read and write, read-only or disabled without changing the customer's credential or touching their data
• Rotate a customer's keys in one click, with the old key stopped immediately
• Retention lists terminated services with a countdown to purge eligibility, the size and object count at termination, and approve and hold controls
• Reconcile compares your AWS account with Blesta and flags orphan buckets, missing buckets and stray IAM users. It only reports and never changes anything
• A health report covers the licence, AWS connection, services by state and usage metering, and an Activity log records every action

What your customers get

• Connection details with copy buttons for the endpoint, bucket, region and access key, and the secret key whenever they need it
• Their own buckets, created and removed within the plan limit, with a typed confirmation before a bucket is deleted
• Versioning per bucket, to recover files that were overwritten or deleted
• Automatic clean-up rules to delete files after a number of days or remove stalled uploads
• Browser access (CORS) rules for web apps, with no AWS console needed
• Expiring share links to download a file, or to let someone send one in, with no account on their side
• Ready-made setups for the AWS CLI, rclone, s3cmd, Cyberduck and WinSCP, cPanel backups and WordPress backup plugins, with the endpoint and keys already filled in
• Usage against their quota, with a 30-day history and a Refresh now button

Each of the bucket, share link and storage settings sections is a switch on the package. Turn one off and it disappears from the customer's page and its actions are refused. The pages follow Blesta's client portal theme and are fully translatable.

Security built in

• Your AWS credentials are stored encrypted and are never sent to the customer or shown on any client page.
• Customers' secret keys are encrypted at rest.
• Customers cannot change their own bucket policy, and cross-bucket replication, Transfer Acceleration and Multi-Region Access Points are not available to them.
• Suspension changes only what the customer's key may do. Read-only keeps downloads working and denies uploads and deletes. Disabled blocks all access. Files are never touched either way.
• Rotating keys on a suspended service never hands out a working key.

One product, every feature

PD AWS S3 is one paid module with everything included: provisioning, metering, quotas, versioning, clean-up rules, CORS, share links, retention and reconcile. There is no free tier and no add-on tier to compare. There are no per-gigabyte fees to us: your buckets live in your own AWS account, you pay Amazon at cost and set your own sell price. Blesta does not invoice usage-based overage, so storage is sold in quota tiers.

If your subscription ever lapses, nothing is deleted. You get a 14-day grace period with everything working, then admin management locks while customers keep being served, and only after that do customer features pause behind a neutral message. Terminated services stay retained and are never purged while the module is unlicensed.

Requirements

• Blesta 6 or later on PHP 8.2 or later, with the ionCube Loader
• An AWS account. A dedicated account is not needed; the module works inside any existing one. It uses Amazon S3, IAM and CloudWatch with the policy we provide
• Blesta's cron running, and its Provision Paid Pending Services task enabled
• PD Modules, the free control panel every PD module installs into