diff --git a/contrib/terraform/techdocs-s3-storage/readme.md b/contrib/terraform/techdocs-s3-storage/readme.md
new file mode 100644
index 0000000000..9615cc8d13
--- /dev/null
+++ b/contrib/terraform/techdocs-s3-storage/readme.md
@@ -0,0 +1 @@
+This terraform file should create a S3 bucket and setup IAM with a user with an inline policy which gives the user access to the bucket. After you have created the bucket, user and policy you should go to the user in the AWS console and create an access key. This access key should be used as the env variables in step 3a [here](https://backstage.io/docs/features/techdocs/using-cloud-storage#configuring-aws-s3-bucket-with-techdocs).
diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf
new file mode 100644
index 0000000000..ca267f0f12
--- /dev/null
+++ b/contrib/terraform/techdocs-s3-storage/terraform.tf
@@ -0,0 +1,81 @@
+#==========================
+# Variables
+#==========================
+
+variable "backstage-bucket" {
+  default = "backstage_bucket_for_my_corp"
+}
+
+variable "backstage-iam" {
+  default = "backstage"
+}
+
+variable "shared-managed-tag-value" {
+  default = "terraform_for_my_corp"
+}
+
+#==========================
+# Bucket
+#==========================
+
+resource "aws_s3_bucket" "backstage" {
+  bucket = var.backstage-bucket
+  acl    = "private"
+  provider = aws
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        sse_algorithm     = "AES256"
+      }
+    }
+  }
+
+  tags = {
+    Name                   = var.backstage-bucket
+    "Managed By Terraform" = var.shared-managed-tag-value
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "backstage" {
+  bucket = aws_s3_bucket.backstage.id
+
+  block_public_acls   = true
+  block_public_policy = true
+  ignore_public_acls = true
+  restrict_public_buckets = true
+}
+
+
+#==========================
+# IAM
+#==========================
+
+resource "aws_iam_user" "backstage" {
+  name = var.backstage-iam
+}
+
+resource "aws_iam_user_policy" "backstage" {
+  name = var.backstage-iam
+  user = aws_iam_user.backstage.name
+  policy = data.aws_iam_policy_document.backstage-policy.json
+}
+
+data "aws_iam_policy_document" "backstage-policy" {
+  statement {
+    actions = [
+      "s3:PutObject",
+      "s3:GetObject",
+      "s3:ListBucket"
+    ]
+    effect = "Allow"
+    resources = [
+      "${aws_s3_bucket.backstage.arn}",
+      "${aws_s3_bucket.backstage.arn}/*",
+    ]
+  }
+}
diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md
index 23015935da..62ee4867c8 100644
--- a/docs/features/techdocs/using-cloud-storage.md
+++ b/docs/features/techdocs/using-cloud-storage.md
@@ -119,6 +119,7 @@ techdocs:
 
 Create a dedicated AWS S3 bucket for the storage of TechDocs sites.
 [Refer to the official documentation](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/create-bucket.html).
+[Terraform example](https://github.com/backstage/backstage/blob/master/contrib/terraform/techdocs-s3-storage/terraform.tf).
 
 TechDocs will publish documentation to this bucket and will fetch files from
 here to serve documentation in Backstage. Note that the bucket names are
@@ -155,7 +156,9 @@ variables**
 You should follow the
 [AWS security best practices guide for authentication](https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html).
 
-TechDocs needs access to read files and metadata of the S3 bucket.
+TechDocs needs access to read files and metadata of the S3 bucket. So if you are
+creating a policy for a user you want to make sure it is granted access to
+ListBucket, GetObject and PutObject.
 
 If the environment variables