Create S3 Bucket

What this is, in plain words

On Amazon Web Services — aws.amazon.com

Amazon rents out storage space by the month, for very little money, and anybody can open an account and use it. You are going to make one place in that storage that belongs to you, and let this site builder put your pictures and videos into it.

What goes in it, and what it costs

Three kinds of file, one bucket

1. Page pictures.

   Your logo, the picture behind a heading, the background of a section or a button. Small, and there are many of them.

2. Product pictures.

   The photograph of each thing you sell. Bigger, because they need to stay sharp when somebody looks closely.

3. Videos.

   Much bigger than either of the above. One video can be larger than every picture on your site put together, which is the real reason this storage is worth having.

Open an Amazon Web Services account

aws.amazon.com → Create an AWS Account

Skip this part if you already have one. An ordinary Amazon shopping account is not the same thing, so you probably need to do this even if you buy from Amazon every week.

1. Go to aws.amazon.com and click Create an AWS Account.
2. Give an email address and a name for the account.

   Use a business email you will still have in five years, not a personal one you might stop using.

3. Give a card.

   Amazon takes a small amount and refunds it, to check the card is real.

4. Confirm your phone number, and pick the free support plan.

   The free plan is the right one. You can change it later if you ever need to.

5. Turn on two-step sign-in when it offers.

   This account will hold your website's files and a card. Two-step sign-in means a stolen password alone is not enough to get in.

Pick a name nobody else has taken

This is the one part people get stuck on

A bucket name has to be unlike every other bucket name in the world, not just unlike yours. Short, obvious names such as "photos" or "media" were taken years ago. A name can never be changed afterwards, so choose it once and write it down.

1. Build your name like this: your business, a dash, the word media, a dash, four numbers of your own choosing.

   So "Hill Street Bakery" becomes hill-street-bakery-media-4417. The four numbers are what make it unlike anybody else's.

2. Use small letters, numbers and dashes only.

   No capital letters, no spaces, no underscores. Amazon refuses those.

3. Keep it between 3 and 63 characters.
4. Write it down before you go any further.

   You will type this same name into three different places, and they all have to match exactly.

Make the bucket

console.aws.amazon.com → S3

1. Sign in to Amazon Web Services and open S3.

   Type S3 into the search box at the top and pick it from the list.

2. Click Create bucket.
3. Type the name you chose.

   If Amazon says the name is already taken, change the four numbers at the end and try again. That is all that is wrong.

4. Choose a region close to most of your visitors.

   If most of them are in the United States, US East (N. Virginia) us-east-1 is the usual choice. Write down which one you picked; you will need it at the end.

5. Leave "Block all public access" ticked on for now.

   It means nobody can go rummaging through your storage directly. You will decide in the next part how your pictures are allowed to be seen, and that decision is the one that matters most.

6. Leave everything else as it comes, and click Create bucket.

Put a delivery service in front of it

console.aws.amazon.com → CloudFront

This is the first of the two ways to let your pictures be seen, and it is the one that also makes them load quickly for somebody on the other side of the country. If you would rather not set this up, do the next part instead — but you must do one of the two, because a bucket that nobody is allowed to read will take your pictures and then show none of them.

1. Open CloudFront and click Create distribution.

   Distribution is simply Amazon's word for one of these delivery setups.

2. For Origin domain, pick your bucket from the list.

   Origin means where the real files are kept.

3. For Origin access, choose Origin access control.

   This is what lets the delivery service read a bucket that is otherwise shut to everybody.

4. Click Create new OAC, accept the name it offers, and click Create.
5. Copy the policy it offers, and paste it onto your bucket.

   A yellow bar appears saying the bucket policy needs updating, with a Copy policy button. Click it, go back to your bucket, open the Permissions tab, edit Bucket policy, paste, and save. That one policy says the delivery service may read your files, and says nothing about anybody else.

6. Leave the rest as it comes and click Create distribution.
7. Write down the Distribution domain name.

   It looks like d111111abcdef8.cloudfront.net. You will need it at the end. A new one says Deploying for a few minutes, which is normal.

Or: let the world read your bucket

console.aws.amazon.com → S3 → your bucket → Permissions

This is the second of the two ways, and it is the quicker one. Instead of putting a delivery service in front of your bucket, you tell the bucket itself that anybody may read a file out of it. Do this or the delivery service above, not both.

Here is the honest trade. Doing it this way takes about five minutes and needs nothing new set up. What you give up is that anybody who knows the exact address of one of your files can open it, without going through your site — which is no worse than it sounds, because every picture on your website is already there for anybody to look at. Your pictures also load a little more slowly for somebody far away, because there is no delivery service helping. Nothing else in your bucket is affected: only reading is allowed, and only reading.

1. Open your bucket and click the Permissions tab.
2. Find "Block public access (bucket settings)" and click Edit.
3. Untick "Block all public access", then untick the two settings underneath it that mention bucket policies.

   Leave the two that mention access control lists ticked on. Those are an older way of granting access that you are not using, and leaving them on keeps one more door shut.

4. Click Save changes, and type confirm when Amazon asks you to.

   Amazon asks because this is a real change. You are allowing the next step to work; nothing is readable yet.

5. Still on the Permissions tab, find Bucket policy and click Edit.
6. Paste this in, with your own bucket name in place of the one shown.

   Change your-bucket-name-0000 to your real bucket name, in both the line that has it. Everything else stays exactly as written.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "AllowPublicReadOfPictures",
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::your-bucket-name-0000/*"
       }
     ]
   }

   In plain words: anybody may read a file out of this bucket, and that is the only thing anybody may do. Nobody can list what is in it, nobody can add anything, and nobody can delete anything. Only the key you make in the next part can do those.

7. Click Save changes.

   Amazon now shows your bucket as Publicly accessible. That is what you asked for and it is correct.

Make a user that can only touch your bucket

console.aws.amazon.com → IAM

This is the careful part, and it is worth going slowly. You are about to give this site builder a key to your Amazon account. The permission below means that key can put a file into your one bucket, read one back, and delete one — and absolutely nothing else, anywhere.

1. Open IAM, choose Users, and click Create user.
2. Name it easy-life-sites.

   So that a year from now it is obvious what this is and where it is used.

3. Do not tick "Provide user access to the AWS Management Console".

   This user is for a program, not a person. It never needs to sign in anywhere.

4. On the permissions step, choose "Attach policies directly", then Create policy.
5. Switch to the JSON tab and replace everything there with this, putting your own bucket name in both lines that mention it.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",
           "s3:GetObject",
           "s3:DeleteObject"
         ],
         "Resource": "arn:aws:s3:::your-bucket-name/*"
       },
       {
         "Effect": "Allow",
         "Action": "s3:ListBucket",
         "Resource": "arn:aws:s3:::your-bucket-name"
       }
     ]
   }

6. Name the policy easy-life-sites-media and create it.
7. Go back to the user you were making, refresh the policy list, tick your new policy, and finish creating the user.

Make its key

console.aws.amazon.com → IAM → Users → easy-life-sites

1. Open that user, go to Security credentials, and click Create access key.
2. Choose "Application running outside AWS" and continue.

   That is what this site builder is, as far as Amazon is concerned.

3. Copy both halves.

   There is an access key ID, starting with AKIA, and a secret access key. Amazon shows the secret once and never again.

4. Keep the secret to yourself until the very last step.

   It is a password. Do not email it, do not put it in a message, do not save it in a document. The only place it goes is the settings box in the next part.

Tell the site builder where your storage is

Your own account page here → the storage card

Four things go in, and then you are finished.

1. Your bucket name.

   Exactly as you typed it on Amazon.

2. Your region.

   The one you chose when you made the bucket, such as us-east-1.

3. Your delivery address, if you made one.

   The d111111abcdef8.cloudfront.net name. Leave this empty only if you let the world read your bucket instead, because one of those two has to be true. When you save, this page writes a small test file into your bucket and then tries to read it back the way a visitor's browser would. If a browser would be turned away, it tells you so and refuses to save, rather than letting you find out after you have uploaded a picture.

4. Your access key ID and secret access key.

   The secret is stored the way a password is stored, and is never shown back to you or to anybody else. Saving it is the last step: from that moment, everything you upload goes into your own storage.

If something goes wrong

The four things that actually go wrong

1. "Bucket name already exists."

   Somebody in the world has that name. Change the four numbers at the end and try again.

2. Saving the settings here says the key was refused.

   Nearly always the bucket name in the permission does not match the real bucket name. Open the policy and compare them letter for letter.

3. Pictures upload but do not appear.

   There are two causes and they are easy to tell apart. If you set up a delivery service, it is probably still saying Deploying, which takes a few minutes — wait, then load the page again. If you did not set one up, then nobody is allowed to read your bucket, which is this exact problem: the picture really is in your storage, and every browser is turned away from it. Go back and do one of the two parts above, either the delivery service or letting the world read your bucket, and then save your settings again.

4. You want to undo all of it.

   Clear the settings on your account page here and the site builder goes back to keeping your files the way it did before. Your bucket and everything in it stays exactly where it is, untouched, because it is yours.