I worry about what happens if the team managing the S3 bucket accidentally changes the bucket access or configuration in a way that stops us being able to upload documents to it... what will happen to form submissions if the S3 upload doesn't work?

@lfdebrux there's a section on this in the spike doc:

To start with we can replicate the current behaviour with email submissions via Notify, where an error message is shown to the form submitter and they are obliged to resubmit.

User research has also suggested that some users would like to receive an email notification that submission failed. This would be basic to start with and the call to action would just be to contact the GOV.UK Forms team. This implies we might want to allow configuration of a support email, to which submission failure notifications would be sent.

In future we could look at temporarily storing submissions so that they can be processed asynchronously. This would provide robustness against submission failures for all submission types (e.g. Notify and SES).

This would allow retries for failed submissions, and would retain failed submission data for a time to allow inspection and replaying submission. This would also allow form fillers to continue submitting forms, even if the submission pipeline isn’t working.

@james-sheppard-gov-uk do you think it's worth incorporating any of that information in here?

Thanks for your comments @lfdebrux and @DavidBiddle - I've made a few additions, please could you take another look?