# Amazon's S3

You can use our AWS S3 (including CloudFront and CloudFront Signed URLs) implementation for faster and more secure delivery via pre-signed urls.

## S3 Storage

To upload your data to Amazon S3, you must first create an S3 bucket in one of the AWS regions:

1. Go to [AWS Console](https://aws.amazon.com/console/) and log in or create an account.
2. After logging in, use **Search for services** and look for **S3**.
3. On the S3 page, click `Buckets > Create bucket`.
4. Specify your bucket `name` and `region`.
5. Enable `Make public using ACL`.
6. Disable `Block all public access`.
7. Enable `I acknowledge that the current settings might result in this bucket and the objects within becoming public`.
8. Keep other settings at defaults, then click **Create bucket**.
9. After successfully creating the bucket, go back to **Search for services** and look for **IAM** (Identity and Access Management) to generate access keys.
10. Go to `Access management > Users` and click **Add users**.
11. Set a `username` and enable `Provide user access to the AWS Management Console - optional`.
12. Under **Set permissions**, choose `Attach policies directly` and search for `AmazonS3FullAccess` (or create a custom policy). Click **Next**.
13. Review, optionally add tags, then click **Create user**.
14. Once created, click the username to view details.
15. Under **Security credentials**, click **Create access key**.
16. In the **Create access key** dialog, choose the option that fits your needs, and click **Create access key**.
17. Note the `AWS Access Key ID` and `Secret access key`—you won’t be able to view the secret again after closing the dialog.
18. In your admin panel (`Admin > Settings > Storage`), add the `bucket name`, `AWS Access Key ID`, and `AWS Secret access key`.

## S3 + CloudFront

Use CloudFront to distribute your content globally by creating a CloudFront distribution:

1. Complete the S3 steps above to have a public bucket ready.
2. Search for **CloudFront** in AWS and click `Distributions > Create distribution`.
3. Under `Origin > Origin Domain`, select your S3 bucket.
4. Most defaults are fine unless you need custom settings.
5. After creating the distribution, copy the `Distribution domain name` (e.g., `abc123.cloudfront.net`), then go to `Admin > Settings > Storage`, add it to `Aws CloudFront Domain Name`, and enable **CloudFront**.
6. For more details, see [Steps for Creating a Distribution](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating.html).

## S3 + CloudFront + Signed URLs

To use signed URLs, you need a *signer* (a trusted key group) in CloudFront.

1. **Create a key pair** (e.g., via OpenSSL):
   1. `openssl genrsa -out private_key.pem 2048`
   2. `openssl rsa -pubout -in private_key.pem -out public_key.pem`
2. **Upload the public key to CloudFront**:
   1. Log into [CloudFront console](https://console.aws.amazon.com/cloudfront/v3/home).
   2. Navigate to `Key management > Public keys > Create public key`.
   3. Give it a **Name**, then paste the contents of `public_key.pem` in the **Key** field.
   4. Copy the **Public Key ID** after adding. This is your `Key-Pair-Id` (and corresponds to `Aws CloudFront Key Pair Id` in the admin panel).
3. **Add the public key to a key group**:
   1. Go to `Key management > Key groups > Create key group`.
   2. Name the group, select the public key, and click **Add**.
   3. Click **Create key group**.
4. **Add a signer to your distribution**:
   1. Open your CloudFront distribution and select the **Behaviors** tab.
   2. Edit the behavior for the path you want to protect.
   3. Under **Restrict Viewer Access**, choose **Yes**.
   4. Under **Trusted Key Groups**, select the group you just created.
   5. Save changes.
5. Add your **Key-Pair-Id** and the path to your `private_key.pem` into `Admin > Settings > Storage`, then enable **CloudFront Signed URLs**.
6. Make sure your S3 bucket permissions are set to public.
7. For more details, see [Serving private content with signed URLs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html).