The Complete Production SOP: How to Deploy and Run Cloudflare R2 Object Storage with Zero Egress Fees in Autonomous AI Agents

---
name: "cloudflare-r2-s3-compatible-storage"
description: "Store and serve multimedia assets globally with 100% S3 API compatibility and zero egress charges."
triggers:
  - "setup cloudflare r2 bucket"
  - "presigned url cloudflare r2"
  - "connect s3 client to r2"
---
# Cloudflare R2 Object Storage with Zero Egress Fees
...

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const accountId = process.env.CLOUDFLARE_ACCOUNT_ID!;

export const r2Client = new S3Client({
  region: 'auto',
  endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
  credentials: {
    accessKeyId: process.env.R2_ACCESS_KEY_ID!,
    secretAccessKey: process.env.R2_SECRET_ACCESS_KEY!,
  },
});

export async function getPresignedUploadUrl(key: string, contentType: string): Promise<string> {
  const command = new PutObjectCommand({
    Bucket: process.env.R2_BUCKET_NAME!,
    Key: key,
    ContentType: contentType,
    CacheControl: 'public, max-age=31536000, immutable',
  });
  return getSignedUrl(r2Client, command, { expiresIn: 3600 });
}

import { getPresignedUploadUrl } from '../lib/r2';

export async function handleAvatarUpload(userId: string, mimeType: string) {
  const fileKey = `avatars/${userId}-${Date.now()}.png`;
  const uploadUrl = await getPresignedUploadUrl(fileKey, mimeType);
  return {
    uploadUrl,
    publicUrl: `https://${process.env.R2_PUBLIC_DOMAIN}/${fileKey}`,
  };
}

#!/usr/bin/env bash
set -euo pipefail

echo "Validating R2 client environment..."
[ -z "${CLOUDFLARE_ACCOUNT_ID:-}" ] && { echo "CLOUDFLARE_ACCOUNT_ID missing"; exit 1; }
[ -z "${R2_ACCESS_KEY_ID:-}" ] && { echo "R2_ACCESS_KEY_ID missing"; exit 1; }
echo "Environment variables validated."