PD AWS S3 for WHMCS

PD AWS S3 lets a hosting company sell Amazon S3 object storage as its own product. Your customer orders a storage plan in your WHMCS cart, and a private bucket with its own access key is created in your AWS account within minutes. The customer manages it from your client area, you set the price, AWS bills you at cost, and the difference is your margin.

It is built for hosts who want to offer S3-compatible storage for backups, websites and applications without handing out AWS logins, without writing scripts to create buckets, and without a support ticket every time a customer needs a new access key.

Why hosts choose PD AWS S3

Every customer is isolated by AWS itself. Each order gets its own bucket and its own dedicated IAM user whose policy covers that customer's buckets only. A customer's key cannot list other buckets in your account, create or delete buckets it does not own, or reach any other AWS service. Isolation is enforced by AWS, not by convention.

Orders set themselves up. The bucket and key are created as soon as WHMCS sets the order up, in the region the customer chose at checkout. Suspend, unsuspend and terminate follow your normal WHMCS billing, so storage follows payment without you touching it.

Fifteen AWS regions, chosen by the customer. Offer North America, Europe, Asia-Pacific and South America from one product. Every region offered is generally available and needs no opt-in in your AWS account.

Usage that bills itself. A daily sweep reads each customer's real storage use from AWS and writes it into WHMCS's own disk-usage fields, so native overage billing, quota warnings and the client-area usage graph work with nothing extra to configure.

Customers help themselves. Extra buckets, versioning, automatic clean-up rules, browser access (CORS), expiring share links and key rotation are all on the customer's own service page. That removes most of the tickets a storage product normally creates.

Nothing is deleted by accident. Termination revokes access at once, but files are kept for a window you set, from 7 to 90 days. Deleting them needs your approval, and an immediate purge needs the exact bucket name typed in.

How it works

1. Connect your AWS account. Add your Access Key ID and Secret Access Key once on a WHMCS server record. We ship the exact policy to use. Test Connection checks S3, IAM and CloudWatch separately and names whichever permission is missing, without creating anything.
2. Create your products. Create a WHMCS product of type Other, choose the module, and let it generate your cart options: Storage Quota, Max Buckets, Versioning and Region. Set your own prices on them.
3. Your customer orders. They pick a quota and a region and pay. The bucket and key are created, and their page shows progress until the storage is ready, usually within a couple of minutes.
4. You get paid, they manage it. WHMCS keeps billing as usual, with usage measured daily. Upgrades and downgrades go through WHMCS's normal flow and keep the customer's data.

What you get in WHMCS

Selling and pricing

• Cart options generated in one click: Storage Quota from 10 GB to 5 TB or Unlimited, Max Buckets from 1 to 10, Versioning on or off, and Region
• Choose which options customers see at checkout; anything you hide is fixed to your product's default, and your prices are kept
• Soft quota mode (the default) warns but keeps uploads working; hard mode pauses uploads at 100% while downloads and deleting keep working, so the customer can free space themselves
• Customers are emailed at 80% and again at 100% of their quota, and you can copy those emails to your administrators
• Usage feeds WHMCS's native overage billing, so you can charge for what customers actually use
• Customer bucket names start with a prefix you choose, so your brand is on every bucket
• More than one AWS account, so you can grow past a single account's IAM user limit

Provisioning you can trust

• Each service creates one IAM user with an inline policy scoped to that customer, and the AWS admin keys never leave your WHMCS server
• A failed setup is never shown as done: the customer sees a plain message and the exact provider error is kept for you in the Activity tab
• Moving a customer to a smaller plan than they already use never deletes anything
• Data is preserved in both directions when a customer upgrades or downgrades
• Nothing is installed on any customer server, and no daemon runs: the module talks to AWS over HTTPS

Running it day to day

• Clients & Storage lists every service with its client, state, access mode, quota percentage, usage and last measurement
• Set any service to read and write, read-only or disabled without changing the customer's credential or touching their data
• Rotate a customer's keys in one click, with the old key stopped immediately
• Retention lists terminated services with a countdown to purge eligibility, the size and object count at termination, and approve and hold controls
• Reconcile compares your AWS account with WHMCS and flags orphan buckets, missing buckets and stray IAM users. It only reports and never changes anything
• A health report covers the licence, AWS connection, services by state and usage metering, and an Activity log records every provisioning, lifecycle and admin action

What your customers get

• Connection details with copy buttons for the endpoint, bucket, region and access key, and the secret key whenever they need it
• Their own buckets, created and removed within the plan limit, with a typed confirmation before a bucket is deleted
• Versioning per bucket, to recover files that were overwritten or deleted
• Automatic clean-up rules to delete files after a number of days or remove stalled uploads
• Browser access (CORS) rules for web apps, with no AWS console needed
• Expiring share links to download a file, or to let someone send one in, with no account on their side
• Ready-made setups for the AWS CLI, rclone, s3cmd, Cyberduck and WinSCP, cPanel backups and WordPress backup plugins, with the endpoint and keys already filled in
• Usage against their quota, with a 30-day history and a Refresh now button

Each of the bucket, share link and storage settings sections is a switch on the product. Turn one off and it disappears from the customer's page and its actions are refused. The pages render on WHMCS's Six, Twenty-One and Nexus themes and are fully translatable.

Security built in

• Your AWS admin credentials are stored encrypted and are never sent to the customer or shown on any client page.
• Customers' secret keys are encrypted at rest.
• Customers cannot change their own bucket policy, and cross-bucket replication, Transfer Acceleration and Multi-Region Access Points are not available to them.
• Suspension changes only what the customer's key may do. Read-only keeps downloads working and denies uploads and deletes. Disabled blocks all access. Files are never touched either way.
• While a service is suspended, rotating its keys never hands out a working key.

One product, every feature

PD AWS S3 is one paid module with everything included: provisioning, metering, quotas, versioning, clean-up rules, CORS, share links, retention and reconcile. There is no free tier and no add-on tier to compare. There are no per-gigabyte fees to us: your buckets live in your own AWS account, you pay Amazon at cost and set your own sell price.

If your subscription ever lapses, nothing is deleted. You get a 14-day grace period with everything working, then admin management locks while customers keep being served, and only after that do customer features pause behind a neutral message. Terminated services stay retained and are never purged while the module is unlicensed.

Requirements

• WHMCS 9 or later on PHP 8.2 or later, with the ionCube Loader
• An AWS account. A dedicated account is not needed; the module works inside any existing one. It uses Amazon S3, IAM and CloudWatch with the policy we provide
• The WHMCS cron running, for the daily usage sweep
• PD Modules, the free control panel every PD module installs into