Amazon S3

Amazon S3 offers the widest choice of regions. Pick it if your company already runs on AWS or needs the files next to other AWS services.

Before you start

• An AWS account and permission to create S3 buckets and IAM users.
• The region you want the files in, for example eu-central-1 (Frankfurt).

1. Create the bucket

1. Open the S3 console, switch to the region you want in the top bar, and choose Create bucket.
2. Choose General purpose as the bucket type and enter a name.
3. Leave Block all public access turned on. CloudFile hands out presigned download links, so the bucket never needs to be public.
4. Choose Create bucket.

Leave Bucket Versioning off unless you need it. With versioning on, deleted and overwritten files are kept as old versions and you keep paying for them. Don’t turn on Object Lock: it stops SFTP users from deleting or replacing files.

2. Create an access key

Create an IAM user that can only reach this one bucket.

1. In the IAM console, go to Users and choose Create user. Name it, for example cloudfile. It doesn’t need console access. Skip the permissions step for now.
2. Open the new user, go to the Permissions tab and choose Add permissions → Create inline policy.
3. Switch to JSON, paste this policy and replace my-bucket with your bucket name:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

4. Give the policy a name and choose Create policy.
5. Go to the user’s Security credentials tab and, under Access keys, choose Create access key. Choose Third-party service as the use case, confirm, and create the key.
6. Copy the Access key and Secret access key. AWS shows the secret only once.

s3:ListBucket applies to the bucket itself; the other actions apply to the objects inside it (/*). That’s why the policy has two statements.

3. Connect it

In CloudFile, go to Storage → Add bucket and choose Amazon S3:

Click Test connection, then Save. To use the bucket, open a server and pick it under Settings → Storage.

Troubleshooting

• Writing a test file failed: The authorization header is malformed; the region … is wrong. The region doesn’t match the bucket. The message names the region AWS expected: enter that one. The endpoint follows the region automatically.
• Writing a test file failed: The AWS Access Key Id you provided does not exist in our records. The access key was mistyped, deleted or deactivated. Check it under the user’s Security credentials.
• Writing a test file failed: Access Denied. The policy names a different bucket, or the object statement is missing /*. Also check for a bucket policy or an organization policy (SCP) that denies the user.
• Listing the bucket failed: Access Denied. s3:ListBucket is missing or points at arn:aws:s3:::my-bucket/*. It must point at the bucket ARN without /*.
• Deleting the test file failed. s3:DeleteObject is missing, or Object Lock is on for the bucket.

See Your own bucket for how files are laid out in the bucket.