Configuration docs explain how to configure plugins.js using env vars, however they say to hardcode values in middlewares.js. I suggest to update docs to something similar to the following, to have values in a single place (not hardcoded). I have it already working properly. module.exports = ({ env }) => ([ // ... { name: 'strapi::security', config: { contentSecurityPolicy: { useDefaults: true, directives: { 'connect-src': ["'self'", 'https:'], 'img-src': [ "'self'", 'data:', 'blob:', env('AWS_BUCKET') + '.s3.' + env('AWS_REGION') + '. amazonaws.com ', ], 'media-src': [ "'self'", 'data:', 'blob:', env('AWS_BUCKET') + '.s3.' + env('AWS_REGION') + '. amazonaws.com ', ], upgradeInsecureRequests: null, }, }, }, }, // ... ]);