Mount your own bucket
An Amazon S3, Cloudflare R2 or Google Cloud Storage bucket appears as a directory in a sandbox (runtime sandbox mount, sbx.mounts.add). The sandbox never holds the bucket's key: Runtime's egress proxy signs each request with it. See mount your own bucket.