Hey guys, need some help. Could be a simple solution but I could not find it in the documentation Does anyone know, how can I delete the files created with core.medplumclient.createattachment method? Thanks so much

[

createAttachment

](https://www.medplum.com/docs/sdk/core.medplumclient.createattachment) is a convenience method for creating a

Binary

resource, so you should be able to get the

Binary

resource from the resulting

Attachment.url

and delete that. Checkout the

createAttachment

code for reference: https://github.com/medplum/medplum/blob/f86debc144a6bb73169bec8b0bf12bebaadeb6b0/packages/core/src/client.ts#L1886

Thank you @node ! That's right. @theurbanerrorist , if you'd like to the delete the

Binary

resources, you can go to app.medplum.com/Binary

Yes but deleting Binary resource only deletes the resource not the file on the s3 bucket. Can you please elaborate on this? The documentation does not mention anything about this.

That's right @theurbanerrorist . This actually a gap in our current implementation 😓 - we currently don't have an API-based way to delete objects from S3

I know this is an old thread -- so please ignore it if it feels irrelevant. But I ran into a similar thing and who knows, maybe it is helpful! So, I implemented a workaround for my bot so it can delete S3 objects directly, and wanted to share it in case it helps others (and also to check if there are any concerns with this approach). What I did: 1. Added

@aws-sdk/client-s3

to our bot (available in Node.js 22 Lambda runtime) 2. Created a helper function that deletes from S3 before deleting the FHIR Binary:

typescript
   import { S3Client, DeleteObjectCommand } from '@aws-sdk/client-s3';

   async function deleteFromS3(medplum: MedplumClient, binaryId: string): Promise<boolean> {
     const BUCKET = 'your-storage-bucket';

     try {
       // Get versionId from Binary resource
       const binary = await medplum.readResource('Binary', binaryId);
       const versionId = binary.meta?.versionId;

       if (!versionId) return false;

       // S3 key format: binary/{binaryId}/{versionId}
       const s3Key = `binary/${binaryId}/${versionId}`;

       const s3 = new S3Client({ region: 'us-east-1' });
       await s3.send(new DeleteObjectCommand({ Bucket: BUCKET, Key: s3Key }));

       return true;
     } catch (error) {
       console.log(`Failed to delete S3 object: ${error.message}`);
       return false;
     }
   }

3. Added

s3:DeleteObject

permission to the bot Lambda role:

bash
   aws iam put-role-policy \
     --role-name YOUR-BotLambdaRole \
     --policy-name S3CleanupPolicy \
     --policy-document '{
       "Version": "2012-10-17",
       "Statement": [{
         "Effect": "Allow",
         "Action": ["s3:DeleteObject"],
         "Resource": "arn:aws:s3:::your-storage-bucket/binary/*"
       }]
     }'

Questions 1. I'm wondering if there might be any concerns with bots directly accessing S3? 2. Are there plans to add S3 deletion to the

deleteResource

/ $expunge operations? Thanks you all!