JustJobs docs

Guide

Amazon's S3

You can use our AWS S3 (including CloudFront and CloudFront Signed URLs) implementation for faster and more secure delivery via pre-signed urls.

S3 Storage

To upload your data to Amazon S3, you must first create an S3 bucket in one of the AWS regions:

  1. Go to AWS Console and log in or create an account.
  2. After logging in, use Search for services and look for S3.
  3. On the S3 page, click Buckets > Create bucket.
  4. Specify your bucket name and region.
  5. Enable Make public using ACL.
  6. Disable Block all public access.
  7. Enable I acknowledge that the current settings might result in this bucket and the objects within becoming public.
  8. Keep other settings at defaults, then click Create bucket.
  9. After successfully creating the bucket, go back to Search for services and look for IAM (Identity and Access Management) to generate access keys.
  10. Go to Access management > Users and click Add users.
  11. Set a username and enable Provide user access to the AWS Management Console - optional.
  12. Under Set permissions, choose Attach policies directly and search for AmazonS3FullAccess (or create a custom policy). Click Next.
  13. Review, optionally add tags, then click Create user.
  14. Once created, click the username to view details.
  15. Under Security credentials, click Create access key.
  16. In the Create access key dialog, choose the option that fits your needs, and click Create access key.
  17. Note the AWS Access Key ID and Secret access key—you won’t be able to view the secret again after closing the dialog.
  18. In your admin panel (Admin > Settings > Storage), add the bucket name, AWS Access Key ID, and AWS Secret access key.

S3 + CloudFront

Use CloudFront to distribute your content globally by creating a CloudFront distribution:

  1. Complete the S3 steps above to have a public bucket ready.
  2. Search for CloudFront in AWS and click Distributions > Create distribution.
  3. Under Origin > Origin Domain, select your S3 bucket.
  4. Most defaults are fine unless you need custom settings.
  5. After creating the distribution, copy the Distribution domain name (e.g., abc123.cloudfront.net), then go to Admin > Settings > Storage, add it to Aws CloudFront Domain Name, and enable CloudFront.
  6. For more details, see Steps for Creating a Distribution.

S3 + CloudFront + Signed URLs

To use signed URLs, you need a signer (a trusted key group) in CloudFront.

  1. Create a key pair (e.g., via OpenSSL):
    • openssl genrsa -out private_key.pem 2048
    • openssl rsa -pubout -in private_key.pem -out public_key.pem
  2. Upload the public key to CloudFront:
    • Log into CloudFront console.
    • Navigate to Key management > Public keys > Create public key.
    • Give it a Name, then paste the contents of public_key.pem in the Key field.
    • Copy the Public Key ID after adding. This is your Key-Pair-Id (and corresponds to Aws CloudFront Key Pair Id in the admin panel).
  3. Add the public key to a key group:
    • Go to Key management > Key groups > Create key group.
    • Name the group, select the public key, and click Add.
    • Click Create key group.
  4. Add a signer to your distribution:
    • Open your CloudFront distribution and select the Behaviors tab.
    • Edit the behavior for the path you want to protect.
    • Under Restrict Viewer Access, choose Yes.
    • Under Trusted Key Groups, select the group you just created.
    • Save changes.
  5. Add your Key-Pair-Id and the path to your private_key.pem into Admin > Settings > Storage, then enable CloudFront Signed URLs.
  6. Make sure your S3 bucket permissions are set to public.
  7. For more details, see Serving private content with signed URLs.