diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8b5c25c821..b1ddd03359 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -109,7 +109,7 @@ parameters:
     default: "main"
     type: string
   sandbox_git_branch:  # change to feature branch to test deployment
-    default: "sj-bind-rds"
+    default: "sj-tf-s3-init"
     type: string
 jobs:
   build:
diff --git a/.gitignore b/.gitignore
index f8e8639221..b9e9bae12c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@ coverage
 junit.xml
 reports
 yarn-error.log
+docs/circleci/test_report.md
 
 # Build related
 build/
diff --git a/deployment_config/dev_vars.yml b/deployment_config/dev_vars.yml
index 44f3d8f473..49bc2c3e02 100644
--- a/deployment_config/dev_vars.yml
+++ b/deployment_config/dev_vars.yml
@@ -7,5 +7,6 @@ NODE_ENV: production
 # This env variable should go away soon in favor of TTA_SMART_HUB_URI
 REDIRECT_URI_HOST: https://tta-smarthub-dev.app.cloud.gov
 rds_instance: ttahub-dev
+s3_doc_upload_bucket: ttahub-document-upload-dev
 SESSION_SECRET: ((SESSION_SECRET))
 TTA_SMART_HUB_URI: https://tta-smarthub-dev.app.cloud.gov
diff --git a/deployment_config/prod_vars.yml b/deployment_config/prod_vars.yml
index 502dab021e..f1c3638067 100644
--- a/deployment_config/prod_vars.yml
+++ b/deployment_config/prod_vars.yml
@@ -7,5 +7,6 @@ NODE_ENV: production
 # This env variable should go away soon in favor of TTA_SMART_HUB_URI
 REDIRECT_URI_HOST: https://tta-smarthub-prod.app.cloud.gov
 rds_instance: ttahub-prod
+s3_doc_upload_bucket: ttahub-document-upload-prod
 SESSION_SECRET: ((SESSION_SECRET))
 TTA_SMART_HUB_URI: https://tta-smarthub-prod.app.cloud.gov
diff --git a/deployment_config/sandbox_vars.yml b/deployment_config/sandbox_vars.yml
index 3ce4e0e7e3..09f42838d5 100644
--- a/deployment_config/sandbox_vars.yml
+++ b/deployment_config/sandbox_vars.yml
@@ -7,5 +7,6 @@ NODE_ENV: production
 # This env variable should go away soon in favor of TTA_SMART_HUB_URI
 REDIRECT_URI_HOST: https://tta-smarthub-sandbox.app.cloud.gov
 rds_instance: ttahub-sandbox
+s3_doc_upload_bucket: ttahub-document-upload-sandbox
 SESSION_SECRET: ((SESSION_SECRET))
 TTA_SMART_HUB_URI: https://tta-smarthub-sandbox.app.cloud.gov
diff --git a/deployment_config/staging_vars.yml b/deployment_config/staging_vars.yml
index 6884c5e1f5..06129b645e 100644
--- a/deployment_config/staging_vars.yml
+++ b/deployment_config/staging_vars.yml
@@ -7,5 +7,6 @@ NODE_ENV: production
 # This env variable should go away soon in favor of TTA_SMART_HUB_URI
 REDIRECT_URI_HOST: https://tta-smarthub-staging.app.cloud.gov
 rds_instance: ttahub-staging
+s3_doc_upload_bucket: ttahub-document-upload-staging
 SESSION_SECRET: ((SESSION_SECRET))
 TTA_SMART_HUB_URI: https://tta-smarthub-staging.app.cloud.gov
diff --git a/docs/circleci/README.md b/docs/circleci/README.md
new file mode 100644
index 0000000000..d9b856392a
--- /dev/null
+++ b/docs/circleci/README.md
@@ -0,0 +1,14 @@
+# CircleCI Export Script
+
+This script exports the test results and artifacts from CircleCI to a markdown file for including in governance documents.
+
+## Setup
+
+Set `CIRCLECI_AUTH_TOKEN` environment variable with your [personal auth token](https://circleci.com/docs/2.0/managing-api-tokens/#creating-a-personal-api-token).
+
+## Things to potentially update:
+
+in `src/circleci.js`
+
+1) `artifactFileNames` regex to determine which artifacts to include
+2) `buildJobsInWorkflow` count to select the number of jobs in a single workflow
diff --git a/docs/circleci/bin/export-ci.js b/docs/circleci/bin/export-ci.js
new file mode 100755
index 0000000000..650eb371c2
--- /dev/null
+++ b/docs/circleci/bin/export-ci.js
@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+
+require = require('esm')(module /*, options*/);
+require("../index.js").exportLastMainTests();
diff --git a/docs/circleci/index.js b/docs/circleci/index.js
new file mode 100644
index 0000000000..34ab8919ab
--- /dev/null
+++ b/docs/circleci/index.js
@@ -0,0 +1,33 @@
+import { getLastTest, getTestMetadata, getTestArtifacts } from './src/circleci';
+import fs from 'fs';
+
+const exportLastMainTests = async (fileName = "test_report.md") => {
+  const lastTestPipeline = await getLastTest();
+  let data = "# Test Results Report\n";
+  for (let job of lastTestPipeline) {
+    let { success, other, exceptions } = await getTestMetadata(job.build_num);
+    let artifacts = await getTestArtifacts(job.build_num);
+    const hasTestReults = success.length > 0 || other.length > 0 || exceptions != null;
+    const hasArtifacts = artifacts.length > 0;
+    if (hasTestReults || hasArtifacts) {
+      data += `\n## ${job.workflows.job_name}\n`;
+      if (hasTestReults) {
+        data += "### Test Results:\n"
+        data += `#### Success:\n\`\`\`\n${JSON.stringify(success, null, 2)}\n\`\`\`\n`;
+        data += `#### Failure:\n\`\`\`\n${JSON.stringify(other, null, 2)}\n\`\`\`\n`
+        data += `#### Exceptions:\n\`\`\`\n${JSON.stringify(exceptions, null, 2)}\n\`\`\`\n`
+      }
+      if (hasArtifacts) {
+        data += `### Artifacts:\n\`\`\`\n${JSON.stringify(artifacts, null, 2)}\n\`\`\`\n`;
+      }
+    }
+  }
+  fs.writeFile(fileName, data, (err) => {
+    if (err) throw err;
+    console.log("Done");
+  })
+}
+
+export {
+  exportLastMainTests
+}
diff --git a/docs/circleci/package.json b/docs/circleci/package.json
new file mode 100644
index 0000000000..d883dbfef1
--- /dev/null
+++ b/docs/circleci/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "circleci-export",
+  "version": "0.0.1",
+  "description": "Export build results out of CircleCI to package for documentation",
+  "main": "index.js",
+  "license": "MIT",
+  "bin": {
+    "export-ci": "bin/export-ci.js"
+  },
+  "dependencies": {
+    "circleci": "^0.3.3",
+    "esm": "^3.2.25",
+    "lodash": "^4.17.20"
+  }
+}
diff --git a/docs/circleci/src/circleci.js b/docs/circleci/src/circleci.js
new file mode 100644
index 0000000000..3090a572f9
--- /dev/null
+++ b/docs/circleci/src/circleci.js
@@ -0,0 +1,55 @@
+import CircleCI from 'circleci';
+import { filter, take, partition } from 'lodash';
+
+const artifactFileNames = /(?:(?:lcov-report\/index|cucumber_report)\.html)|(?:^reports\/.*\.png)$/;
+const buildJobsInWorkflow = 7;
+const workflowName = "build_test_deploy";
+
+const ci = new CircleCI({
+  auth: process.env.CIRCLECI_AUTH_TOKEN
+});
+
+const getLastTest = async () => {
+  const lastBuilds = await ci.getBranchBuilds({
+    username: "HHS",
+    project: "Head-Start-TTADP",
+    branch: "main",
+  });
+  return take(
+    filter(
+      lastBuilds,
+      (b) => (b.workflows.workflow_name === workflowName)
+    ),
+    buildJobsInWorkflow);
+}
+
+const getTestMetadata = async (buildNum) => {
+  const { tests, exceptions } = await ci.getTestMetadata({
+    username: "HHS",
+    project: "Head-Start-TTADP",
+    build_num: buildNum
+  });
+  const [ success, other ] = partition(tests, ({result}) => (result === "success"));
+
+  return {
+    success,
+    other,
+    exceptions
+  }
+}
+
+const getTestArtifacts = async (buildNum) => {
+  const artifacts = await ci.getBuildArtifacts({
+    username: "HHS",
+    project: "Head-Start-TTADP",
+    build_num: buildNum
+  });
+  return filter(artifacts, ({path}) => (path.match(artifactFileNames)));
+}
+
+export default ci;
+export {
+  getLastTest,
+  getTestMetadata,
+  getTestArtifacts
+}
diff --git a/docs/circleci/yarn.lock b/docs/circleci/yarn.lock
new file mode 100644
index 0000000000..0d50fc9651
--- /dev/null
+++ b/docs/circleci/yarn.lock
@@ -0,0 +1,344 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+ajv@^6.12.3:
+  version "6.12.6"
+  resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.12.6.tgz#baf5a62e802b07d977034586f8c3baf5adf26df4"
+  integrity sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==
+  dependencies:
+    fast-deep-equal "^3.1.1"
+    fast-json-stable-stringify "^2.0.0"
+    json-schema-traverse "^0.4.1"
+    uri-js "^4.2.2"
+
+asn1@~0.2.3:
+  version "0.2.4"
+  resolved "https://registry.yarnpkg.com/asn1/-/asn1-0.2.4.tgz#8d2475dfab553bb33e77b54e59e880bb8ce23136"
+  integrity sha512-jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg==
+  dependencies:
+    safer-buffer "~2.1.0"
+
+assert-plus@1.0.0, assert-plus@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/assert-plus/-/assert-plus-1.0.0.tgz#f12e0f3c5d77b0b1cdd9146942e4e96c1e4dd525"
+  integrity sha1-8S4PPF13sLHN2RRpQuTpbB5N1SU=
+
+asynckit@^0.4.0:
+  version "0.4.0"
+  resolved "https://registry.yarnpkg.com/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"
+  integrity sha1-x57Zf380y48robyXkLzDZkdLS3k=
+
+aws-sign2@~0.7.0:
+  version "0.7.0"
+  resolved "https://registry.yarnpkg.com/aws-sign2/-/aws-sign2-0.7.0.tgz#b46e890934a9591f2d2f6f86d7e6a9f1b3fe76a8"
+  integrity sha1-tG6JCTSpWR8tL2+G1+ap8bP+dqg=
+
+aws4@^1.8.0:
+  version "1.11.0"
+  resolved "https://registry.yarnpkg.com/aws4/-/aws4-1.11.0.tgz#d61f46d83b2519250e2784daf5b09479a8b41c59"
+  integrity sha512-xh1Rl34h6Fi1DC2WWKfxUTVqRsNnr6LsKz2+hfwDxQJWmrx8+c7ylaqBMcHfl1U1r2dsifOvKX3LQuLNZ+XSvA==
+
+bcrypt-pbkdf@^1.0.0:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz#a4301d389b6a43f9b67ff3ca11a3f6637e360e9e"
+  integrity sha1-pDAdOJtqQ/m2f/PKEaP2Y342Dp4=
+  dependencies:
+    tweetnacl "^0.14.3"
+
+caseless@~0.12.0:
+  version "0.12.0"
+  resolved "https://registry.yarnpkg.com/caseless/-/caseless-0.12.0.tgz#1b681c21ff84033c826543090689420d187151dc"
+  integrity sha1-G2gcIf+EAzyCZUMJBolCDRhxUdw=
+
+circleci@^0.3.3:
+  version "0.3.3"
+  resolved "https://registry.yarnpkg.com/circleci/-/circleci-0.3.3.tgz#64f0301aca002df00747a448f226d302a31c0c6c"
+  integrity sha1-ZPAwGsoALfAHR6RI8ibTAqMcDGw=
+  dependencies:
+    q "^1.0.1"
+    request "^2.36.0"
+
+combined-stream@^1.0.6, combined-stream@~1.0.6:
+  version "1.0.8"
+  resolved "https://registry.yarnpkg.com/combined-stream/-/combined-stream-1.0.8.tgz#c3d45a8b34fd730631a110a8a2520682b31d5a7f"
+  integrity sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==
+  dependencies:
+    delayed-stream "~1.0.0"
+
+core-util-is@1.0.2:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz#b5fd54220aa2bc5ab57aab7140c940754503c1a7"
+  integrity sha1-tf1UIgqivFq1eqtxQMlAdUUDwac=
+
+dashdash@^1.12.0:
+  version "1.14.1"
+  resolved "https://registry.yarnpkg.com/dashdash/-/dashdash-1.14.1.tgz#853cfa0f7cbe2fed5de20326b8dd581035f6e2f0"
+  integrity sha1-hTz6D3y+L+1d4gMmuN1YEDX24vA=
+  dependencies:
+    assert-plus "^1.0.0"
+
+delayed-stream@~1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/delayed-stream/-/delayed-stream-1.0.0.tgz#df3ae199acadfb7d440aaae0b29e2272b24ec619"
+  integrity sha1-3zrhmayt+31ECqrgsp4icrJOxhk=
+
+ecc-jsbn@~0.1.1:
+  version "0.1.2"
+  resolved "https://registry.yarnpkg.com/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz#3a83a904e54353287874c564b7549386849a98c9"
+  integrity sha1-OoOpBOVDUyh4dMVkt1SThoSamMk=
+  dependencies:
+    jsbn "~0.1.0"
+    safer-buffer "^2.1.0"
+
+esm@^3.2.25:
+  version "3.2.25"
+  resolved "https://registry.yarnpkg.com/esm/-/esm-3.2.25.tgz#342c18c29d56157688ba5ce31f8431fbb795cc10"
+  integrity sha512-U1suiZ2oDVWv4zPO56S0NcR5QriEahGtdN2OR6FiOG4WJvcjBVFB0qI4+eKoWFH483PKGuLuu6V8Z4T5g63UVA==
+
+extend@~3.0.2:
+  version "3.0.2"
+  resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz#f8b1136b4071fbd8eb140aff858b1019ec2915fa"
+  integrity sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==
+
+extsprintf@1.3.0:
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.3.0.tgz#96918440e3041a7a414f8c52e3c574eb3c3e1e05"
+  integrity sha1-lpGEQOMEGnpBT4xS48V06zw+HgU=
+
+extsprintf@^1.2.0:
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.4.0.tgz#e2689f8f356fad62cca65a3a91c5df5f9551692f"
+  integrity sha1-4mifjzVvrWLMplo6kcXfX5VRaS8=
+
+fast-deep-equal@^3.1.1:
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
+  integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
+
+fast-json-stable-stringify@^2.0.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz#874bf69c6f404c2b5d99c481341399fd55892633"
+  integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
+
+forever-agent@~0.6.1:
+  version "0.6.1"
+  resolved "https://registry.yarnpkg.com/forever-agent/-/forever-agent-0.6.1.tgz#fbc71f0c41adeb37f96c577ad1ed42d8fdacca91"
+  integrity sha1-+8cfDEGt6zf5bFd60e1C2P2sypE=
+
+form-data@~2.3.2:
+  version "2.3.3"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.3.3.tgz#dcce52c05f644f298c6a7ab936bd724ceffbf3a6"
+  integrity sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==
+  dependencies:
+    asynckit "^0.4.0"
+    combined-stream "^1.0.6"
+    mime-types "^2.1.12"
+
+getpass@^0.1.1:
+  version "0.1.7"
+  resolved "https://registry.yarnpkg.com/getpass/-/getpass-0.1.7.tgz#5eff8e3e684d569ae4cb2b1282604e8ba62149fa"
+  integrity sha1-Xv+OPmhNVprkyysSgmBOi6YhSfo=
+  dependencies:
+    assert-plus "^1.0.0"
+
+har-schema@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/har-schema/-/har-schema-2.0.0.tgz#a94c2224ebcac04782a0d9035521f24735b7ec92"
+  integrity sha1-qUwiJOvKwEeCoNkDVSHyRzW37JI=
+
+har-validator@~5.1.3:
+  version "5.1.5"
+  resolved "https://registry.yarnpkg.com/har-validator/-/har-validator-5.1.5.tgz#1f0803b9f8cb20c0fa13822df1ecddb36bde1efd"
+  integrity sha512-nmT2T0lljbxdQZfspsno9hgrG3Uir6Ks5afism62poxqBM6sDnMEuPmzTq8XN0OEwqKLLdh1jQI3qyE66Nzb3w==
+  dependencies:
+    ajv "^6.12.3"
+    har-schema "^2.0.0"
+
+http-signature@~1.2.0:
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/http-signature/-/http-signature-1.2.0.tgz#9aecd925114772f3d95b65a60abb8f7c18fbace1"
+  integrity sha1-muzZJRFHcvPZW2WmCruPfBj7rOE=
+  dependencies:
+    assert-plus "^1.0.0"
+    jsprim "^1.2.2"
+    sshpk "^1.7.0"
+
+is-typedarray@~1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/is-typedarray/-/is-typedarray-1.0.0.tgz#e479c80858df0c1b11ddda6940f96011fcda4a9a"
+  integrity sha1-5HnICFjfDBsR3dppQPlgEfzaSpo=
+
+isstream@~0.1.2:
+  version "0.1.2"
+  resolved "https://registry.yarnpkg.com/isstream/-/isstream-0.1.2.tgz#47e63f7af55afa6f92e1500e690eb8b8529c099a"
+  integrity sha1-R+Y/evVa+m+S4VAOaQ64uFKcCZo=
+
+jsbn@~0.1.0:
+  version "0.1.1"
+  resolved "https://registry.yarnpkg.com/jsbn/-/jsbn-0.1.1.tgz#a5e654c2e5a2deb5f201d96cefbca80c0ef2f513"
+  integrity sha1-peZUwuWi3rXyAdls77yoDA7y9RM=
+
+json-schema-traverse@^0.4.1:
+  version "0.4.1"
+  resolved "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz#69f6a87d9513ab8bb8fe63bdb0979c448e684660"
+  integrity sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==
+
+json-schema@0.2.3:
+  version "0.2.3"
+  resolved "https://registry.yarnpkg.com/json-schema/-/json-schema-0.2.3.tgz#b480c892e59a2f05954ce727bd3f2a4e882f9e13"
+  integrity sha1-tIDIkuWaLwWVTOcnvT8qTogvnhM=
+
+json-stringify-safe@~5.0.1:
+  version "5.0.1"
+  resolved "https://registry.yarnpkg.com/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz#1296a2d58fd45f19a0f6ce01d65701e2c735b6eb"
+  integrity sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus=
+
+jsprim@^1.2.2:
+  version "1.4.1"
+  resolved "https://registry.yarnpkg.com/jsprim/-/jsprim-1.4.1.tgz#313e66bc1e5cc06e438bc1b7499c2e5c56acb6a2"
+  integrity sha1-MT5mvB5cwG5Di8G3SZwuXFastqI=
+  dependencies:
+    assert-plus "1.0.0"
+    extsprintf "1.3.0"
+    json-schema "0.2.3"
+    verror "1.10.0"
+
+lodash@^4.17.20:
+  version "4.17.20"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.20.tgz#b44a9b6297bcb698f1c51a3545a2b3b368d59c52"
+  integrity sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA==
+
+mime-db@1.44.0:
+  version "1.44.0"
+  resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.44.0.tgz#fa11c5eb0aca1334b4233cb4d52f10c5a6272f92"
+  integrity sha512-/NOTfLrsPBVeH7YtFPgsVWveuL+4SjjYxaQ1xtM1KMFj7HdxlBlxeyNLzhyJVx7r4rZGJAZ/6lkKCitSc/Nmpg==
+
+mime-types@^2.1.12, mime-types@~2.1.19:
+  version "2.1.27"
+  resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.27.tgz#47949f98e279ea53119f5722e0f34e529bec009f"
+  integrity sha512-JIhqnCasI9yD+SsmkquHBxTSEuZdQX5BuQnS2Vc7puQQQ+8yiP5AY5uWhpdv4YL4VM5c6iliiYWPgJ/nJQLp7w==
+  dependencies:
+    mime-db "1.44.0"
+
+oauth-sign@~0.9.0:
+  version "0.9.0"
+  resolved "https://registry.yarnpkg.com/oauth-sign/-/oauth-sign-0.9.0.tgz#47a7b016baa68b5fa0ecf3dee08a85c679ac6455"
+  integrity sha512-fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==
+
+performance-now@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/performance-now/-/performance-now-2.1.0.tgz#6309f4e0e5fa913ec1c69307ae364b4b377c9e7b"
+  integrity sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns=
+
+psl@^1.1.28:
+  version "1.8.0"
+  resolved "https://registry.yarnpkg.com/psl/-/psl-1.8.0.tgz#9326f8bcfb013adcc005fdff056acce020e51c24"
+  integrity sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==
+
+punycode@^2.1.0, punycode@^2.1.1:
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.1.1.tgz#b58b010ac40c22c5657616c8d2c2c02c7bf479ec"
+  integrity sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==
+
+q@^1.0.1:
+  version "1.5.1"
+  resolved "https://registry.yarnpkg.com/q/-/q-1.5.1.tgz#7e32f75b41381291d04611f1bf14109ac00651d7"
+  integrity sha1-fjL3W0E4EpHQRhHxvxQQmsAGUdc=
+
+qs@~6.5.2:
+  version "6.5.2"
+  resolved "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz#cb3ae806e8740444584ef154ce8ee98d403f3e36"
+  integrity sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==
+
+request@^2.36.0:
+  version "2.88.2"
+  resolved "https://registry.yarnpkg.com/request/-/request-2.88.2.tgz#d73c918731cb5a87da047e207234146f664d12b3"
+  integrity sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==
+  dependencies:
+    aws-sign2 "~0.7.0"
+    aws4 "^1.8.0"
+    caseless "~0.12.0"
+    combined-stream "~1.0.6"
+    extend "~3.0.2"
+    forever-agent "~0.6.1"
+    form-data "~2.3.2"
+    har-validator "~5.1.3"
+    http-signature "~1.2.0"
+    is-typedarray "~1.0.0"
+    isstream "~0.1.2"
+    json-stringify-safe "~5.0.1"
+    mime-types "~2.1.19"
+    oauth-sign "~0.9.0"
+    performance-now "^2.1.0"
+    qs "~6.5.2"
+    safe-buffer "^5.1.2"
+    tough-cookie "~2.5.0"
+    tunnel-agent "^0.6.0"
+    uuid "^3.3.2"
+
+safe-buffer@^5.0.1, safe-buffer@^5.1.2:
+  version "5.2.1"
+  resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
+  integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
+
+safer-buffer@^2.0.2, safer-buffer@^2.1.0, safer-buffer@~2.1.0:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
+  integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
+
+sshpk@^1.7.0:
+  version "1.16.1"
+  resolved "https://registry.yarnpkg.com/sshpk/-/sshpk-1.16.1.tgz#fb661c0bef29b39db40769ee39fa70093d6f6877"
+  integrity sha512-HXXqVUq7+pcKeLqqZj6mHFUMvXtOJt1uoUx09pFW6011inTMxqI8BA8PM95myrIyyKwdnzjdFjLiE6KBPVtJIg==
+  dependencies:
+    asn1 "~0.2.3"
+    assert-plus "^1.0.0"
+    bcrypt-pbkdf "^1.0.0"
+    dashdash "^1.12.0"
+    ecc-jsbn "~0.1.1"
+    getpass "^0.1.1"
+    jsbn "~0.1.0"
+    safer-buffer "^2.0.2"
+    tweetnacl "~0.14.0"
+
+tough-cookie@~2.5.0:
+  version "2.5.0"
+  resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-2.5.0.tgz#cd9fb2a0aa1d5a12b473bd9fb96fa3dcff65ade2"
+  integrity sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==
+  dependencies:
+    psl "^1.1.28"
+    punycode "^2.1.1"
+
+tunnel-agent@^0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/tunnel-agent/-/tunnel-agent-0.6.0.tgz#27a5dea06b36b04a0a9966774b290868f0fc40fd"
+  integrity sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0=
+  dependencies:
+    safe-buffer "^5.0.1"
+
+tweetnacl@^0.14.3, tweetnacl@~0.14.0:
+  version "0.14.5"
+  resolved "https://registry.yarnpkg.com/tweetnacl/-/tweetnacl-0.14.5.tgz#5ae68177f192d4456269d108afa93ff8743f4f64"
+  integrity sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q=
+
+uri-js@^4.2.2:
+  version "4.4.0"
+  resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.0.tgz#aa714261de793e8a82347a7bcc9ce74e86f28602"
+  integrity sha512-B0yRTzYdUCCn9n+F4+Gh4yIDtMQcaJsmYBDsTSG8g/OejKBodLQ2IHfN3bM7jUsRXndopT7OIXWdYqc1fjmV6g==
+  dependencies:
+    punycode "^2.1.0"
+
+uuid@^3.3.2:
+  version "3.4.0"
+  resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
+  integrity sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==
+
+verror@1.10.0:
+  version "1.10.0"
+  resolved "https://registry.yarnpkg.com/verror/-/verror-1.10.0.tgz#3a105ca17053af55d6e270c1f8288682e18da400"
+  integrity sha1-OhBcoXBTr1XW4nDB+CiGguGNpAA=
+  dependencies:
+    assert-plus "^1.0.0"
+    core-util-is "1.0.2"
+    extsprintf "^1.2.0"
diff --git a/manifest.yml b/manifest.yml
index 417aa2ff57..785bfcccda 100644
--- a/manifest.yml
+++ b/manifest.yml
@@ -10,7 +10,8 @@ applications:
       NODE_ENV: ((NODE_ENV))
       # Soon to be removed in favor of TTA_SMART_HUB_URI
       REDIRECT_URI_HOST: ((REDIRECT_URI_HOST))
-      TTA_SMART_HUB_URI: ((TTA_SMART_HUB_URI))
       SESSION_SECRET: ((SESSION_SECRET))
+      TTA_SMART_HUB_URI: ((TTA_SMART_HUB_URI))
     services:
       - ((rds_instance))
+      - ((s3_doc_upload_bucket))
diff --git a/terraform/dev/main.tf b/terraform/dev/main.tf
index 82742eff27..dbd6f60b81 100644
--- a/terraform/dev/main.tf
+++ b/terraform/dev/main.tf
@@ -52,3 +52,17 @@ resource "cloudfoundry_service_instance" "database" {
   space        = data.cloudfoundry_space.space.id
   service_plan = data.cloudfoundry_service.rds.service_plans["micro-psql"]
 }
+
+###
+# S3 bucket
+###
+
+data "cloudfoundry_service" "s3" {
+  name = "s3"
+}
+
+resource "cloudfoundry_service_instance" "document_upload_bucket" {
+  name         = "ttahub-document-upload-${var.env}"
+  space        = data.cloudfoundry_space.space.id
+  service_plan = data.cloudfoundry_service.s3.service_plans["basic"]
+}
diff --git a/terraform/prod/main.tf b/terraform/prod/main.tf
index a42253239f..5103a02072 100644
--- a/terraform/prod/main.tf
+++ b/terraform/prod/main.tf
@@ -52,3 +52,17 @@ resource "cloudfoundry_service_instance" "database" {
   space        = data.cloudfoundry_space.space.id
   service_plan = data.cloudfoundry_service.rds.service_plans["small-psql"]
 }
+
+###
+# S3 bucket
+###
+
+data "cloudfoundry_service" "s3" {
+  name = "s3"
+}
+
+resource "cloudfoundry_service_instance" "document_upload_bucket" {
+  name         = "ttahub-document-upload-${var.env}"
+  space        = data.cloudfoundry_space.space.id
+  service_plan = data.cloudfoundry_service.s3.service_plans["basic"]
+}
diff --git a/terraform/sandbox/main.tf b/terraform/sandbox/main.tf
index aeb4a3d1d1..7f13608834 100644
--- a/terraform/sandbox/main.tf
+++ b/terraform/sandbox/main.tf
@@ -52,3 +52,17 @@ resource "cloudfoundry_service_instance" "database" {
   space        = data.cloudfoundry_space.space.id
   service_plan = data.cloudfoundry_service.rds.service_plans["micro-psql"]
 }
+
+###
+# S3 bucket
+###
+
+data "cloudfoundry_service" "s3" {
+  name = "s3"
+}
+
+resource "cloudfoundry_service_instance" "document_upload_bucket" {
+  name         = "ttahub-document-upload-${var.env}"
+  space        = data.cloudfoundry_space.space.id
+  service_plan = data.cloudfoundry_service.s3.service_plans["basic"]
+}
diff --git a/terraform/staging/main.tf b/terraform/staging/main.tf
index 7f93fcd972..9e3318baac 100644
--- a/terraform/staging/main.tf
+++ b/terraform/staging/main.tf
@@ -52,3 +52,17 @@ resource "cloudfoundry_service_instance" "database" {
   space        = data.cloudfoundry_space.space.id
   service_plan = data.cloudfoundry_service.rds.service_plans["micro-psql"]
 }
+
+###
+# S3 bucket
+###
+
+data "cloudfoundry_service" "s3" {
+  name = "s3"
+}
+
+resource "cloudfoundry_service_instance" "document_upload_bucket" {
+  name         = "ttahub-document-upload-${var.env}"
+  space        = data.cloudfoundry_space.space.id
+  service_plan = data.cloudfoundry_service.s3.service_plans["basic"]
+}