Prisma.Bucket reference

Bucket

Source: src/Prisma/Bucket.ts

A Prisma Object Store bucket inside a Prisma project.

A project change replaces the bucket. Display name, branch, and logical ID changes update it in place; the display name is a label only, so the provider-side bucket name, its objects, and its access keys stay the same. Destroying this resource deletes the bucket, its objects, and any remaining access keys — the Management API cascades the deletion server-side.

Bucket: Creating a Bucket

const bucket = yield* Prisma.Bucket("uploads", {
  project,
  name: "uploads",
});

Bucket: Accessing a Bucket

const key = yield* Prisma.BucketAccessKey("uploads-key", {
  bucket,
  role: "read_write",
});

BucketAccessKey

Source: src/Prisma/BucketAccessKey.ts

An access key for a Prisma Object Store bucket, yielding S3 credentials.

Prisma returns the secret access key only in the create response, so Alchemy stores it as a Redacted value and treats persisted state as authoritative: once created, the secret is never re-read from the API. Changing the bucket, name, or role replaces the key with fresh credentials.

BucketAccessKey: Creating a Bucket Access Key

const key = yield* Prisma.BucketAccessKey("uploads-key", {
  bucket,
  role: "read_write",
});

BucketAccessKey: Binding to Platforms

const app = yield* Prisma.Compute("api", {
  project,
  path: "./apps/api",
  env: {
    S3_ENDPOINT: key.endpoint,
    S3_BUCKET: key.bucketName,
    S3_ACCESS_KEY_ID: key.accessKeyId,
    S3_SECRET_ACCESS_KEY: key.secretAccessKey,
  },
});

ReadBucket

Source: src/Prisma/ReadBucket.ts

Bind a Prisma Object Store Bucket to a Prisma Compute app, AWS Lambda Function, or Cloudflare Worker with read-only access, and obtain the typed runtime client.

Binding creates a read-scoped Prisma.BucketAccessKey for the bucket and carries its S3 credentials into the host environment, so the caller never handles a credential themselves.

Provide ReadBucketBinding on the host implementation.

Prisma bucket keys carry one of two coarse roles, read and read_write. This binding mints the read one, so the credential it puts in the host environment cannot write, and ReadBucketClient exposes no write operations either.

ReadBucket: Binding a Bucket

export default Prisma.Compute(
  "api",
  { project, main: import.meta.filename },
  Effect.gen(function* () {
    const uploads = yield* Prisma.ReadBucket(bucket);

    return {
      fetch: Effect.gen(function* () {
        const object = yield* uploads.get("reports/2026.json");
        return yield* HttpServerResponse.json(
          object === null ? null : yield* object.json(),
        );
      }),
    };
  }).pipe(Effect.provide(Prisma.ReadBucketBinding)),
);

ReadWriteBucket

Source: src/Prisma/ReadWriteBucket.ts

Bind a Prisma Object Store Bucket to a Prisma Compute app, AWS Lambda Function, or Cloudflare Worker with read and write access, and obtain the typed runtime client.

Binding creates a read-write Prisma.BucketAccessKey for the bucket and carries its S3 credentials into the host environment, so the caller never handles a credential themselves.

Provide ReadWriteBucketBinding on the host implementation.

Use ReadBucket instead where read-only access is enough: Prisma bucket keys have a read role, so that binding’s credential genuinely cannot write.

ReadWriteBucket: Binding a Bucket

export default Prisma.Compute(
  "api",
  { project, main: import.meta.filename },
  Effect.gen(function* () {
    const uploads = yield* Prisma.ReadWriteBucket(bucket);

    return {
      fetch: Effect.gen(function* () {
        yield* uploads.put("hits", "1");
        const object = yield* uploads.get("hits");
        return yield* HttpServerResponse.text(
          object === null ? "" : yield* object.text(),
        );
      }),
    };
  }).pipe(Effect.provide(Prisma.ReadWriteBucketBinding)),
);

WriteBucket

Source: src/Prisma/WriteBucket.ts

Bind a Prisma Object Store Bucket to a Prisma Compute app, AWS Lambda Function, or Cloudflare Worker with write access, and obtain the typed runtime client.

Binding creates a Prisma.BucketAccessKey for the bucket and carries its S3 credentials into the host environment, so the caller never handles a credential themselves.

Provide WriteBucketBinding on the host implementation.

Role caveat. Prisma bucket keys carry one of two coarse roles, read and read_write; there is no write-only role. This binding therefore mints a read_write key, and the credential it puts in the host environment can also read. The write-only contract is enforced client-side — WriteBucketClient exposes no read operations — and becomes a server-side boundary if Prisma grows a write-only role.

WriteBucket: Binding a Bucket

export default Prisma.Compute(
  "api",
  { project, main: import.meta.filename },
  Effect.gen(function* () {
    const uploads = yield* Prisma.WriteBucket(bucket);

    return {
      fetch: Effect.gen(function* () {
        yield* uploads.put("reports/2026.json", JSON.stringify({ ok: true }), {
          contentType: "application/json",
        });
        return yield* HttpServerResponse.empty({ status: 204 });
      }),
    };
  }).pipe(Effect.provide(Prisma.WriteBucketBinding)),
);