diff --git a/enos/ci/service-user-iam/main.tf b/enos/ci/service-user-iam/main.tf
index 4bb30c4e7..2453dab37 100644
--- a/enos/ci/service-user-iam/main.tf
+++ b/enos/ci/service-user-iam/main.tf
@@ -216,7 +216,10 @@ data "aws_iam_policy_document" "enos_policy_document" {
       "rds:ListTagsForResource",
       "rds:ModifyDBInstance",
       "rds:ModifyDBSubnetGroup",
-      "rds:RemoveTagsFromResource"
+      "rds:RemoveTagsFromResource",
+      "s3:ListAllMyBuckets",
+      "s3:CreateBucket",
+      "s3:DeleteBucket",
     ]
     resources = ["*"]
   }
@@ -243,7 +246,9 @@ data "aws_iam_policy_document" "aws_nuke_policy_document" {
       "iam:ListUserTags",
       "iam:ListUsers",
       "iam:UntagUser",
-      "servicequotas:ListServiceQuotas"
+      "servicequotas:ListServiceQuotas",
+      "s3:ListAllMyBuckets",
+      "s3:DeleteBucket",
     ]
     resources = ["*"]
   }
diff --git a/enos/modules/bucket/locals.tf b/enos/modules/bucket/locals.tf
new file mode 100644
index 000000000..46e4a21e6
--- /dev/null
+++ b/enos/modules/bucket/locals.tf
@@ -0,0 +1,13 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+locals {
+  common_tags = merge(
+    var.common_tags,
+    {
+      Type     = var.cluster_tag
+      Module   = "bucket"
+      BucketID = random_pet.default.id
+    },
+  )
+}
diff --git a/enos/modules/bucket/main.tf b/enos/modules/bucket/main.tf
new file mode 100644
index 000000000..ca3000ca7
--- /dev/null
+++ b/enos/modules/bucket/main.tf
@@ -0,0 +1,33 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+resource "random_pet" "default" {}
+
+resource "aws_s3_bucket" "default" {
+  bucket_prefix = "enos-${random_pet.default.id}-"
+  force_destroy = true
+  tags          = local.common_tags
+}
+
+data "aws_iam_policy_document" "default" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "s3:PutObject",
+      "s3:GetObject",
+      "s3:DeleteObject",
+      "s3:GetObjectAttributes",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.default.arn}/*",
+    ]
+  }
+}
+
+resource "aws_iam_user_policy" "default" {
+  name   = "${aws_s3_bucket.default.id}_${var.user}_access"
+  user   = var.user
+  policy = data.aws_iam_policy_document.default.json
+}
diff --git a/enos/modules/bucket/outputs.tf b/enos/modules/bucket/outputs.tf
new file mode 100644
index 000000000..c40b18a76
--- /dev/null
+++ b/enos/modules/bucket/outputs.tf
@@ -0,0 +1,7 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+output "bucket_name" {
+  value       = aws_s3_bucket.default.id
+  description = "The name of the S3 bucket created by this module."
+}
diff --git a/enos/modules/bucket/variables.tf b/enos/modules/bucket/variables.tf
new file mode 100644
index 000000000..dceeafbc9
--- /dev/null
+++ b/enos/modules/bucket/variables.tf
@@ -0,0 +1,18 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+variable "common_tags" {
+  description = "A map of tags to set for the S3 bucket."
+  type        = map(string)
+  default     = { "Project" : "Enos" }
+}
+
+variable "cluster_tag" {
+  description = "The cluster_tag from the Boundary cluster module."
+  type        = string
+}
+
+variable "user" {
+  description = "A username that will be allowed access to this module's bucket."
+  type        = string
+}
diff --git a/enos/modules/iam_setup/main.tf b/enos/modules/iam_setup/main.tf
index edcaa4816..8c307cdae 100644
--- a/enos/modules/iam_setup/main.tf
+++ b/enos/modules/iam_setup/main.tf
@@ -46,3 +46,8 @@ output "secret_access_key" {
   value     = aws_iam_access_key.boundary.secret
   sensitive = true
 }
+
+output "user_name" {
+  description = "The name of the user created by this module."
+  value       = aws_iam_user.boundary.name
+}