S3Vault
Cloud saves, player files and content on Amazon S3

Overview

S3Vault connects your game to Amazon S3 without a server of your own. Players sign in to (or get a guest identity from) an Amazon Cognito identity pool, receive temporary AWS credentials, and read and write objects in your bucket — limited by an IAM policy to their own folder.

• Save Game To Cloud / Load Game From Cloud for any Save Game object.
• Files are streamed from and to disk, never loaded whole into memory; large files are uploaded in parallel parts.
• Downloads go to <file>.part and are renamed when complete, so a failed or cancelled download never leaves a broken file.
• Folder downloads for content packs, with Skip Existing to fetch only what changed in size.
• List, inspect, copy and delete objects; presigned GET and PUT links.
• Every node is latent and cancellable; requests run on worker threads and results arrive on the game thread.

S3Vault has 28 Blueprint nodes: 17 latent nodes, 9 configuration and identity functions and the Cancel / Is Finished functions of every latent node.

Requirements

Installation

1. Install S3Vault from Fab into your engine, or copy the S3Vault folder into your project's Plugins folder.
2. Open the project, enable S3Vault in Edit > Plugins and restart the editor.
3. Open Project Settings > Plugins > S3Vault and set Region, Identity Pool Id, Default Bucket and Key Prefix.
4. C++ only: add PublicDependencyModuleNames.Add("S3Vault"); to your Build.cs.

Setting up AWS

1. Bucket. In the S3 console create a bucket (for example my-game-saves) in the region you set in the project settings. Keep Block all public access enabled — players reach the bucket with their own credentials, not publicly.
2. Identity pool. In Amazon Cognito create an identity pool. Enable guest (unauthenticated) access if players should save before signing in, and add the identity providers you use (a Cognito user pool, Google, Apple, Facebook or OpenID). Copy the pool id (us-east-1:0123...) to Identity Pool Id.
3. Role policy. Attach the policy below to the pool's authenticated role (and to the guest role if you allow guests). Replace my-game-saves, and use the same folder as your Key Prefix (players/{IdentityId}).
4. Optional: enable Transfer Acceleration on the bucket and tick Use Transfer Acceleration for faster uploads from far-away players.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListOwnFolderAndContent",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-game-saves",
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "players/${cognito-identity.amazonaws.com:sub}/*",
            "dlc/*"
          ]
        }
      }
    },
    {
      "Sid": "ReadWriteOwnFiles",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::my-game-saves/players/${cognito-identity.amazonaws.com:sub}/*"
    },
    {
      "Sid": "ReadSharedContent",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-game-saves/dlc/*"
    }
  ]
}

${cognito-identity.amazonaws.com:sub} is the player's Cognito identity id — exactly what S3Vault puts in place of {IdentityId}, so every player can only list, read, write and delete below their own players/<identity id>/ folder. The dlc/ statements give every player read access to shared content (download it with an absolute key such as /dlc/pack1/); drop them if you do not ship content packs.

Keys & prefixes

Every node takes a Bucket (empty = Default Bucket) and a Key. Keys are relative to the Key Prefix unless they start with /:

Tokens: {IdentityId} = the player's Cognito identity id (resolved automatically before every request in Cognito Identity Pool mode; in the other modes a key that uses it fails with IdentityUnavailable), {Region} = the configured region. Resolve Key shows the final key. Keys returned by the nodes (Info > Key, list results, failed keys) use the same relative form, so you can pass them straight back; Info > Full Key holds the complete S3 key.

Prefixes work like folders: saves/ matches everything in the saves folder, saves also matches saves-old/.... The folder nodes always treat their prefix as a folder.

Local paths that are relative are relative to the project's Saved folder; absolute paths are used as given (for content packs, Project Persistent Download Dir is a good choice on every platform).

Quick start

Blueprint

1. Create your Save Game object as usual (Create Save Game Object) and fill it.
2. Add Save Game To Cloud, connect the object and set Key to saves/slot1.sav.
3. To load, add Load Game From Cloud with the same Key and cast Save Game on On Success to your class.
4. On On Failure, check Error > Code: NoSuchKey means there is no cloud save yet.
5. For big files use Upload File / Download File and bind On Progress to a progress bar (Bytes Done / Total Bytes).

C++

// Build.cs: PublicDependencyModuleNames.Add("S3Vault");
#include "S3VaultAsyncActions.h"

void AMyGameMode::DownloadPack()
{
    US3VaultDownloadFolderAction* Action = US3VaultDownloadFolderAction::DownloadFolder(this,
        TEXT("/dlc/pack1/"), FPaths::ProjectPersistentDownloadDir() / TEXT("Pack1"), FString(), /*bSkipExisting*/ true);
    Action->OnProgress.AddDynamic(this, &AMyGameMode::OnPackProgress); // (int32 FilesDone, int32 FilesTotal)
    Action->OnSuccess.AddDynamic(this, &AMyGameMode::OnPackDone);      // (int32 FileCount, const TArray<FString>& FailedFiles, const FS3VaultError& Error)
    Action->OnFailure.AddDynamic(this, &AMyGameMode::OnPackDone);
    Action->Activate();
}

Every latent node is a UBlueprintAsyncActionBase: call its static factory, bind the delegates (they are dynamic, so the handlers must be UFUNCTIONs), then call Activate(). Keep the returned pointer if you want to call Cancel().

Uploads & downloads

Progress is reported at most about 10 times per second, always on the game thread. Cancel stops the request immediately; a cancelled multipart upload is aborted on S3 so no orphaned parts are billed.

Save games

Folders & content packs

A failed file does not stop the others: the node finishes with On Failure, the number of files that succeeded and the list of failed files, and Error describes the first failure.

Object management

Identity & configuration

Types

Settings

Project Settings > Plugins > S3Vault (saved to DefaultGame.ini). Changes apply to the next request.

Error codes

Troubleshooting

Credits

© 2026 Alpha XP — alphaxp.net · Support: support@alphaxp.net. Built and verified for Unreal Engine 4.27 and 5.8. Includes the AWS SDK for C++ 1.11.916 (Apache-2.0).