S3 Movie Search

S3 Movie Search is a Next.js demo template that fetches movie metadata and poster images from a private Amazon S3 general purpose bucket, connecting to AWS without hardcoded access tokens through Vercel's OIDC Federation.

What is S3 Movie Search?

S3 Movie Search is a Next.js application template deployed on Vercel that reads a catalog of movies and their poster images from an Amazon S3 general purpose bucket. It takes a private S3 bucket filled with poster files and movie metadata as input, and produces a searchable movie poster front end. Vercel exchanges its OIDC token for temporary AWS credentials, so the bucket stays private and poster responses are cached on Vercel's CDN.

Key Features

• Next.js front end — the demo is built with Next.js and deployed as a Vercel project.
• Private S3 bucket — the bucket remains private; Vercel OIDC tokens are exchanged for temporary AWS credentials instead of storing hardcoded access tokens.
• Vercel OIDC Federation — secure backend access to AWS is handled through Vercel's OIDC integration documented at vercel.com.
• Automatic first-deployment seeding — the first deployment downloads posters and uploads them with the catalog before building; later deployments find the catalog already in the bucket and skip straight to the build.
• Manual sync script — npm run sync:s3 uploads the catalog and posters straight to the private bucket using Vercel OIDC credentials, skipping posters that already exist.
• 4,395 poster-backed movies — the catalog is drawn from the TMDB 5000 Movie Dataset; movies without a confirmed poster are omitted.
• CDN caching — poster responses are cached on Vercel's CDN.
• One-click deploy — the Vercel Deploy button clones the repo, creates a Vercel project, sets up the AWS integration, and provisions a new S3 general purpose bucket.

Who is it for?

• Next.js developers exploring how to read private S3 objects from a Vercel deployment without long-lived AWS keys.
• Teams adopting Vercel OIDC Federation who want a working reference for exchanging OIDC tokens for temporary AWS credentials.
• Developers building media catalogs who need a pattern for serving poster images from a private bucket through a CDN cache.

Use cases

• Prototyping a media catalog: deploy the template, let the first build seed the bucket, and get a browsable movie poster search running with no manual AWS key setup.
• Testing OIDC-to-AWS access: use the template as a starting point to verify that a Vercel project can assume an IAM role via OIDC and read objects from a private bucket.
• Loading a local catalog: run npm run sync:s3 to upload posters and metadata from your machine to the connected bucket before starting the dev server.

How does S3 Movie Search work?

Clicking the Deploy button clones the repository, creates a Vercel project, sets up the AWS integration, and provisions a new S3 general purpose bucket. The first deployment downloads the posters and uploads them with the catalog before building; subsequent deployments detect the existing catalog and skip straight to the build. Locally, you link the directory with npx vercel link, pull environment variables with npx vercel env pull .env.local, install dependencies, run npm run sync:s3 if needed, and start with npm run dev at http://localhost:3000.

FAQ

What dataset powers the movie catalog?

The catalog contains 4,395 poster-backed movies from the TMDB 5000 Movie Dataset on Kaggle; movies without a confirmed poster are omitted. The product uses the TMDB API but is not endorsed or certified by TMDB.

Do I need AWS access keys to run it?

No. The bucket stays private and Vercel exchanges its OIDC token for temporary AWS credentials, so no hardcoded access tokens are required. To connect a bucket to an existing project instead, the Vercel AWS Native Integration provisions an IAM role and adds the required S3 environment variables.

What are the requirements?

You need Amazon S3 installed through the Vercel AWS Marketplace integration, Node.js 20 or newer, and the Vercel CLI.

Why is S3_BUCKET_NAME missing from .env.local?

vercel env pull reads the project's Development environment. The Deploy button connects the bucket to every environment, but connecting it from the dashboard leaves Development unchecked by default; enable Development on the bucket's project connection and pull again.