Write to a customer's storage

In this example, we are going to give every customer object storage in their own cloud while keeping the application backend hosted in yours. The backend will write a file, read it, list the bucket, and delete the file through one scoped interface.

Files stay in the customer's AWS, Google Cloud, or Azure account. Your backend does not receive a general cloud credential, and you do not need to deploy application compute beside the bucket when storage operations are all you need.

Because the backend only needs storage operations, this stack does not need a Worker or Container. A Remote Binding gives the backend a scoped Storage API for the selected deployment.

╔══════════════════════╗      ┌────────────────┐      ╔════════════════════════╗
║ Your cloud           ║      │ Alien          │      ║ Customer cloud         ║
║                      ║      │                │      ║                        ║
║ Backend              ║─────▶│ Remote Binding │─────▶║ Storage resource       ║
║ get / put / list     ║◀─────│                │◀─────║ for this deployment    ║
╚══════════════════════╝      └────────────────┘      ╚════════════════════════╝

We will declare the Storage resource in alien.ts, enable remote access, and use it from src/vendor.ts. Alien creates the corresponding bucket for each deployment; the backend does not need a cloud-provider credential.

Describe the bucket in alien.ts

const uploads = new alien.Storage("uploads").build()

export default new alien.Stack("byob-storage")
  .add(uploads, "frozen", { remoteAccess: true })
  .build()

remoteAccess: true lets your hosted backend use this Storage resource through Alien. Storage is frozen, so customer setup owns the bucket: an ordinary rollout cannot replace or delete it. Changing its infrastructure configuration requires setup authority again.

Use the same storage API from your backend

const bindings = await Bindings.forRemoteDeployment({
  deploymentId: process.env.ALIEN_DEPLOYMENT_ID!,
  token: process.env.ALIEN_API_TOKEN!,
})

const uploads = bindings.storage("uploads")
await uploads.put("hello.txt", new TextEncoder().encode("hello"))

const object = await uploads.get("hello.txt")
console.log(new TextDecoder().decode(object.data))

Add a Worker only when code also needs to run with the Storage resource.

Try the complete example

cd examples/byob-storage-ts
pnpm install
alien release

Enable remoteAccess only for resources your backend actually needs, and keep the Alien credential in server-side secret storage.

Read alien.ts for the Storage resource and src/vendor.ts for the Remote Binding. The example creates a bucket during customer setup; it does not attach an arbitrary existing bucket.

What you built

You provisioned customer-owned state without moving application compute. Customer files stay in their cloud account, while your hosted backend receives only the Storage operations for the selected deployment—not a reusable AWS, Google Cloud, or Azure credential.

Source: examples/byob-storage-ts.

Next: Remote Bindings, Storage.