Ziska

Please discuss with in Sprint calls if this is not possible and provide an alternate suggestion:

User Story

As a Ziska administrator and implementation team member, I want all Project Manager images to be securely stored in AWS S3 by environment so that project assets are organized, secure, scalable, and isolated between Development, UAT, Stage, and Production.

Business Requirement

All images uploaded through the Ziska Project Manager shall be stored in Amazon S3. Images shall not be stored on the application server or in the database.

Each application environment will use its own dedicated S3 bucket:

ziska-projectmanager-dev
ziska-projectmanager-uat
ziska-projectmanager-stage
ziska-projectmanager-prod

The application shall determine the appropriate S3 bucket based on the current environment configuration.

Folder Structure

Within each S3 bucket, images shall be organized as follows:

Retailers/
{RetailerID}/
{ProjectID}/
Requirements/
Mockups/
Logos/
Artwork/
Testing/
Documentation/
Completed/
Functional Requirements
Store all uploaded Project Manager images in the environment-specific AWS S3 bucket.
Do not store image files on the web server.
Do not store image binaries in the database. Store only the image URL/path and metadata.
Automatically create the folder structure when a new retailer or project is created.
Generate unique filenames to prevent duplicate file names.
Support multiple image uploads per project.
Allow authorized users to:
Upload images
View images
Download images
Delete images (if permitted)
Secure access using AWS IAM permissions and application role-based security.
Image Metadata

Each uploaded image shall include:

Retailer ID
Project ID
Original Filename
Stored Filename
File Type
File Size
Image Category
Uploaded By
Upload Date/Time
Version Number (future enhancement)
AWS S3 Object URL/Key
Configuration

Each environment shall contain its own configurable S3 bucket name.

Example:

Development → ziska-projectmanager-dev
UAT → ziska-projectmanager-uat
Stage → ziska-projectmanager-stage
Production → ziska-projectmanager-prod

No code changes shall be required when promoting the application between environments. Only the environment configuration shall determine the target bucket.

Security Requirements
Images shall be encrypted at rest using AWS S3 encryption.
Access shall be limited to authenticated application users.
Direct public access to S3 buckets shall be disabled.
Bucket permissions shall follow the principle of least privilege.
Acceptance Criteria
Images upload successfully to the correct S3 bucket based on the application environment.
Images are organized according to the required folder structure.
No images are stored on the application server.
Database records contain image metadata and S3 object references only.
Users can upload, view, and download images according to their permissions.
Production images are completely isolated from Development, UAT, and Stage.
Bucket names are configurable without requiring application code changes.
Upload failures return meaningful error messages and do not create incomplete database records.
Future Enhancements (Not Included in This Story)
Image version history
Image approval workflow
Thumbnail generation
Image annotations/comments
Automatic image optimization
Lifecycle policies for archival and retention
Audit history for image uploads, updates, and deletions
Virus scanning of uploaded files