JustFans docs

Guide

Amazon's S3

Use our AWS S3 implementation (including CloudFront and CloudFront Signed URLs) for faster and more secure delivery via pre-signed URLs.

S3 Storage

Follow these steps to upload and configure your data on Amazon S3:

  1. Create an S3 Bucket:
    • Go to the AWS Console and log in or create an account.
    • Search for S3 and click Buckets > Create bucket.
    • Set a Bucket name and Region.
    • Enable ACLs and disable Block all public access.
    • Acknowledge the warning: I acknowledge that the current settings might result in this bucket and the objects within becoming public.
    • Click Create bucket.
  2. Create an IAM User with S3 Permissions:
    • Go to IAM > Access management > Users and click Add users.
    • Assign a Username and choose Attach policies directly.
    • Select AmazonS3FullAccess and proceed.
    • After creation, open the user page and generate an Access key under Security credentials.
    • Copy the Access Key ID and Secret Access Key. You won’t be able to see the secret again later.
  3. Set CORS Configuration:
    • Select your bucket and go to the Permissions tab.
    • Scroll down to Cross-origin resource sharing (CORS) and click Edit.
    • Paste the following JSON config and save:
      [ { "AllowedHeaders": ["*"], "AllowedMethods": ["GET"], "AllowedOrigins": ["*"], "ExposeHeaders": [], "MaxAgeSeconds": 3000 } ]

You can restrict AllowedOrigins to your actual domain for better security (e.g., ["https://yourdomain.com"]).

  1. Configure S3 in the Admin Panel:
    • Go to Admin > Settings > Storage.
    • Fill in the Bucket name, AWS Access Key ID, and AWS Secret Access Key.

S3 + CloudFront

Use CloudFront to distribute your content globally:

  1. Search for CloudFront in the AWS Console and go to Distributions > Create distribution.
  2. Copy the Distribution domain name (e.g., abc123.cloudfront.net) and configure it in Admin > Settings > Storage under Aws CloudFront Domain Name.
  3. Adjust your CDN Distribution Origin settings:
    • Open your distribution and navigate to the Origins tab.
    • Edit your origin and set Origin access to Origin access control settings.
    • Under Origin Access Control:
      • Click Create new OAC and keep the default settings.
      • Click Create.
    • Select the newly created OAC from the dropdown list.
    • Click Save changes.
  4. Update the S3 bucket policy to allow CloudFront access while retaining IAM user write permissions:
    { "Version": "2008-10-17", "Statement": [ { "Sid": "AllowCloudFrontAccess", "Effect": "Allow", "Principal": {"Service": "cloudfront.amazonaws.com"}, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::your-bucket-name/*", "Condition": { "StringEquals": { "AWS:SourceArn": "arn:aws:cloudfront::your-account-id:distribution/your-cdn-distribution-id" } } }, { "Sid": "AllowIAMUserWrite", "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::your-account-id:user/your-iam-user-name"}, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::your-bucket-name/*" } ] }
  5. Adjust Bucket Access Settings:
    • Disable Block all public access.
    • Manually select options to allow write access for IAM users while restricting object access to CloudFront. Disable Block all public access and enable all the options manually except Block public access to buckets and objects granted through new access control lists (ACLs)

S3 + CloudFront + Signed URLs

Follow these steps to use signed URLs for secure access:

  1. Create a key pair (e.g., via OpenSSL):

The steps below use OpenSSL as an example. There are other methods as well.

  • Generate a private key: openssl genrsa -out private_key.pem 2048
  • Extract the public key: openssl rsa -pubout -in private_key.pem -out public_key.pem
  1. Upload the public key to CloudFront:
    • Log into CloudFront console.
    • Go to Key management > Public keys > Create public key.
    • Paste the contents of public_key.pem and save.
    • Copy the Public Key ID after adding. This is your Key-Pair-Id (and corresponds to Aws CloudFront Key Pair Id in the admin panel).
  2. Create a key group:
    • Go to Key management > Key groups > Create key group.
    • Add the uploaded public key to the group and save.
  3. Link the key group to your distribution:
    • Open your distribution settings and edit the behavior for the desired path.
    • Enable Restrict Viewer Access and select the trusted key group.
  4. Navigate to Admin > Settings > Storage in your admin panel.
  • Add the following:
  • Enable CloudFront PreSigned URLs.

For more information, refer to the official AWS documentation on private content with signed URLs.