Configuration docs explain how to configure plugins.js using env vars, however they say to hardcode values in middlewares.js. I suggest to update docs to something similar to the following, to have values in a single place (not hardcoded). I have it already working properly.
module.exports = ({ env }) => ([
// ...
{
name: 'strapi::security',
config: {
contentSecurityPolicy: {
useDefaults: true,
directives: {
'connect-src': ["'self'", 'https:'],
'img-src': [
"'self'",
'data:',
'blob:',
env('AWS_BUCKET') + '.s3.' + env('AWS_REGION') + '.amazonaws.com',
],
'media-src': [
"'self'",
'data:',
'blob:',
env('AWS_BUCKET') + '.s3.' + env('AWS_REGION') + '.amazonaws.com',
],
upgradeInsecureRequests: null,
},
},
},
},
// ...
]);