AWS puts S3 inside the Vercel Marketplace and swaps static keys for OIDC federation

October 14, 2026. AWS made Amazon S3 available on the Vercel Marketplace and in v0, Vercel’s interface-generation editor. Three resource types. That is what you can now provision without leaving your development environment: S3 general purpose buckets, S3 Tables for managed Apache Iceberg tables, and S3 Vectors for vector storage. October 19, 2026. The AWS Weekly Roundup names it one of the week’s two headline items. Why it matters: the interesting part is not the catalog entry — it is the authentication mechanism, an OIDC token exchange that removes the static access key from the path to your data.

What Vercel actually provisions

Until now, a developer hosting on Vercel who wanted object storage had to open the AWS console, create a bucket, mint an IAM user, generate a key pair, then paste those keys into environment variables. It was the mental round-trip that broke the flow, and the long-lived key that then sat in a .env file or a project secret.

The Vercel Marketplace folds that sequence into the dashboard: pick AWS, choose a bucket type, a region, and a name, and provisioning takes a few seconds. The three types serve different workloads. The general purpose bucket handles almost anything — static assets, user uploads, backups. S3 Tables deliver fully managed Iceberg tables tuned for analytics. S3 Vectors store and query vectors natively at scale, for AI applications doing similarity search.

S3 joins integrations that already existed — Amazon Aurora, Amazon DynamoDB, and Amazon OpenSearch Serverless. The whole stack deploys into a single AWS account with a single bill, but is configured from the tool the developer already uses. That is the strategic shift: AWS is no longer asking the developer to come to it — it is going where the developer works.

The mechanism that matters: OIDC instead of a static key

The most interesting part of the announcement is a single sentence: Vercel establishes a secure connection to AWS “leveraging Vercel’s OIDC Federation and Amazon S3 IAM authentication,” with no hardcoded access key. In practice, at runtime a short-lived OIDC token is exchanged with AWS Security Token Service for temporary credentials scoped to the resource in question.

The difference from the classic pattern is structural. A static access key never expires, is easy to duplicate, and once leaked stays valid until someone revokes it by hand. An OIDC token exchanged for STS credentials lives for minutes, is scoped to the target bucket, and never exists as a secret stored in project configuration. It is exactly the model GitHub Actions imposed on the CI/CD ecosystem with its OIDC provider: remove the long-lived key from the pipeline.

For a front-end team the consequence is concrete. No key rotation to manage, no secret leaking into a public repository, no “who still has that key?” during an audit. Governance moves from the configuration file to identity federation — where it should have been all along.

The strategy: buying distribution on the developer’s turf

This integration did not come out of nowhere. AWS and Vercel have been drawing their surfaces closer for several quarters, and the October 14 announcement is the logical endpoint. The commercial message is clear: new AWS accounts created through Vercel receive $100 in credits, valid for up to six months, usable across Amazon S3, OpenSearch Serverless, and the database services. Existing AWS customers can link their account to use S3 with their Vercel projects.

It is an acquisition bet. By entering the Vercel Marketplace, AWS captures developers who would never have crossed the console threshold, and converts them into S3 customers at their first serious deployment. Object storage is the perfect entry product: it is cheap, inert, and once data is written, migrating to a competitor is a real project. The $100 in credits is a trivial acquisition cost next to the value of a bucket that grows month after month.

Availability is global: S3 on Vercel works in every AWS Region where Vercel is present. For a team deploying on the Edge via Vercel, that means placing storage near its users without abandoning the single console of its hosting provider.

What the integration does not solve

Let us bound the scope, because the temptation is to read more into this than it contains. First, S3 on Vercel is still AWS S3: the bill lands on the AWS account, not the Vercel bill. The integration simplifies provisioning and connection; it does not merge the two billing systems. A team that never watches its AWS account can find a surprise on a bill it barely looked at.

Second, OIDC federation solves the static key problem, not the wider IAM governance problem. The temporary credentials are scoped to the resource, but it is still the IAM policy that defines what they can do. An overly broad policy — s3:* across the whole account — remains overly broad regardless of how the credentials are issued. Security moves from one link to another; it does not disappear.

Finally, the choice of bucket type is not neutral and should not be left to the default. S3 Tables and S3 Vectors are not interchangeable with a general purpose bucket: they have specific cost models and use cases. Provisioning an S3 Table to store static assets is paying an analytics engine to do a shop-window job. Simplicity of provisioning does not excuse not understanding what you are provisioning.

The practical path: link your existing account

The integration is most valuable when it points at an account you already own, not a fresh one. Linking an existing AWS account keeps your IAM policies, your VPC peering, and your cost allocation in place, while the $100 credits apply only to new accounts created through Vercel. The two paths are deliberately different: the credits are an acquisition offer for developers who have never touched AWS, while the account link is for teams that already pay a monthly AWS bill and simply want to stop managing a static key.

One operational nuance worth flagging: the OIDC exchange is scoped to the resource, but the resources you provision from Vercel still live in your AWS account and inherit its regions, retention, and tags. If your team has a tagging policy for cost allocation, apply it at creation time — a bucket created in a hurry without tags becomes the same untracked cost as any other, just provisioned faster.

Verdict

If your team hosts on Vercel and consumes object storage, turn on the S3 integration and delete your static IAM keys: the OIDC → STS model is strictly better, and the migration cost is zero because provisioning takes seconds. If you already run a mature AWS account, link it rather than creating a new one — you keep a single bill and your existing IAM policies. If you need analytics or vector search, choose S3 Tables or S3 Vectors explicitly rather than a general-purpose bucket. The October 14 announcement does not create a new S3: it removes the friction and the static key that separated the front-end developer from their storage — and that is exactly the part that deserved to go.

References

• AWS — Amazon S3 is now available on the Vercel Marketplace and v0 by Vercel (October 14, 2026)
• AWS News Blog — Amazon S3 is now available on the Vercel Marketplace and v0 by Vercel
• AWS News Blog — AWS Weekly Roundup (October 19, 2026)
• Vercel — Amazon S3 joins the Vercel Marketplace
• Vercel Marketplace — AWS S3